go-pkgz / email / 32199955332

93%

master: 93%

Build Type

Pull #31

github

Committed by paskal

Commit Message

Format attachment file names into mime part headers safely

Previously, the file name went into the Content-Type name parameter by
plain string concatenation, so a name containing CR or LF ended the header
and injected part headers and a body of its own. Content-Disposition was
built with %q and escaped those, but its quoting was still wrong for names
holding a quote, a semicolon or non-ascii characters.

After this change, both headers are built with mime.FormatMediaType, which
quotes and RFC 2231 encodes the name, and a file name containing CR or LF
is rejected outright, which also keeps Content-ID safe.

The generated headers change shape for every attachment: parameters are no
longer quoted when they don't need to be, so tests assert file names from
the parsed mime tree instead of matching the serialized header text.

Pull Request Pull Request #31: Format attachment file names into mime part headers safely

Coverage Stats

15 of 19 new or added lines in 1 file covered. (78.95%)

8 existing lines in 1 file now uncovered.

379 of 412 relevant lines covered (91.99%)

217.09 hits per line