go-pkgz / email / 32201330356

93%

master: 93%

Pull #31

github

Format attachment file names into mime part headers safely

Previously, the file name went into the Content-Type name parameter by
plain string concatenation, so a name containing CR or LF ended the header
and injected part headers and a body of its own. Content-Disposition was
built with %q and escaped those, but its quoting was still wrong for names
holding a quote, a semicolon or non-ascii characters.

After this change, both headers are built with mime.FormatMediaType, which
quotes and RFC 2231 encodes the name, and a file name containing CR or LF
is rejected outright, which also keeps Content-ID safe.

The generated headers change shape for every attachment: parameters are no
longer quoted when they don't need to be, so tests assert file names from
the parsed mime tree instead of matching the serialized header text.

14 of 14 new or added lines in 1 file covered. (100.0%)

378 of 407 relevant lines covered (92.87%)

219.72 hits per line