From 2b4c7d09b040cb5827591afa7c3820d9139f179e Mon Sep 17 00:00:00 2001 From: Andras Dobrosi Date: Fri, 7 Feb 2025 10:29:05 +0100 Subject: [PATCH] Match ContentDisposition attributes case-insensitively This commit ensures that `ContentDisposition` parses attributes like "filename" and "filename*" in a case insensitive fashion, per RFC 6266. Closes gh-34383 Signed-off-by: Andras Dobrosi [brian.clozel@broadcom.com: apply code conventions] Signed-off-by: Brian Clozel --- .../org/springframework/http/ContentDisposition.java | 5 +++-- .../springframework/http/ContentDispositionTests.java | 10 +++++++++- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/spring-web/src/main/java/org/springframework/http/ContentDisposition.java b/spring-web/src/main/java/org/springframework/http/ContentDisposition.java index 03d1e84ee84..cf591ef8d3d 100644 --- a/spring-web/src/main/java/org/springframework/http/ContentDisposition.java +++ b/spring-web/src/main/java/org/springframework/http/ContentDisposition.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2023 the original author or authors. + * Copyright 2002-2025 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -25,6 +25,7 @@ import java.util.ArrayList; import java.util.Base64; import java.util.BitSet; import java.util.List; +import java.util.Locale; import java.util.regex.Matcher; import java.util.regex.Pattern; @@ -354,7 +355,7 @@ public final class ContentDisposition { String part = parts.get(i); int eqIndex = part.indexOf('='); if (eqIndex != -1) { - String attribute = part.substring(0, eqIndex); + String attribute = part.substring(0, eqIndex).toLowerCase(Locale.ROOT); String value = (part.startsWith("\"", eqIndex + 1) && part.endsWith("\"") ? part.substring(eqIndex + 2, part.length() - 1) : part.substring(eqIndex + 1)); diff --git a/spring-web/src/test/java/org/springframework/http/ContentDispositionTests.java b/spring-web/src/test/java/org/springframework/http/ContentDispositionTests.java index 50612a84d4d..0c623407bae 100644 --- a/spring-web/src/test/java/org/springframework/http/ContentDispositionTests.java +++ b/spring-web/src/test/java/org/springframework/http/ContentDispositionTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2025 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -223,6 +223,14 @@ class ContentDispositionTests { .build()); } + @Test + void parseAttributesCaseInsensitively() { + ContentDisposition cd = ContentDisposition.parse("form-data; Name=\"foo\"; FileName=\"bar.txt\""); + assertThat(cd.getName()).isEqualTo("foo"); + assertThat(cd.getFilename()).isEqualTo("bar.txt"); + assertThat(cd.toString()).isEqualTo("form-data; name=\"foo\"; filename=\"bar.txt\""); + } + @Test void parseEmpty() { assertThatIllegalArgumentException().isThrownBy(() -> parse(""));