[CherryPy] #1079: Incorrect splitting of header elements

[CherryPy]

#1079: Incorrect splitting of header elements
----------------------------+-----------------------------------------------
Reporter: ho...@podio.com | Owner: fumanchu
Type: defect | Status: new
Priority: normal | Milestone:
Component: CherryPy code | Keywords:
----------------------------+-----------------------------------------------
Today I ran into an issue with multipart/form-data upload to cherrypy 3.2.
After a long session of debugging the problem was caused by incorrect
splitting of header elements on comma. A multipart header part of the POST
looked like this:

Content-Disposition: form-data; filename="pom.xml"; modification-
date="Thu, 11 Aug 2011 21:25:46 GMT"; size=4485; name="source"

The header_elements function in httputil was splitting this header on
comma, without respect of the quotes. This lead to the name being skipped.
As the part had no name, it was not added to entity params in cpreqbody in
process_multipart_form_data.

The fix is to correctly split the header using a regular expression such
as:

re_header_split = re.compile(',(?=(?:[^"]*"[^"]*")*[^"]*$)')

and then use it like this:

for element in re_header_split.split(fieldvalue):

in httputil.header_elements

--
Ticket URL: <http://www.cherrypy.org/ticket/1079>
CherryPy <http://www.cherrypy.org>
CherryPy - a pythonic, object-oriented HTTP framework

[CherryPy]

#1079: Incorrect splitting of header elements
----------------------------+-----------------------------------------------
Reporter: ho...@podio.com | Owner: fumanchu
Type: defect | Status: new
Priority: normal | Milestone:

Component: CherryPy code | Resolution:
Keywords: |
----------------------------+-----------------------------------------------
Old description:

> Today I ran into an issue with multipart/form-data upload to cherrypy
> 3.2. After a long session of debugging the problem was caused by
> incorrect splitting of header elements on comma. A multipart header part
> of the POST looked like this:
>
> Content-Disposition: form-data; filename="pom.xml"; modification-
> date="Thu, 11 Aug 2011 21:25:46 GMT"; size=4485; name="source"
>
> The header_elements function in httputil was splitting this header on
> comma, without respect of the quotes. This lead to the name being
> skipped. As the part had no name, it was not added to entity params in
> cpreqbody in process_multipart_form_data.
>
> The fix is to correctly split the header using a regular expression such
> as:
>
> re_header_split = re.compile(',(?=(?:[^"]*"[^"]*")*[^"]*$)')
>
> and then use it like this:
>
> for element in re_header_split.split(fieldvalue):
>
> in httputil.header_elements

New description:

Today I ran into an issue with multipart/form-data upload to cherrypy 3.2.
After a long session of debugging the problem was caused by incorrect
splitting of header elements on comma. A multipart header part of the POST
looked like this:

Content-Disposition: form-data; filename="pom.xml"; modification-
date="Thu, 11 Aug 2011 21:25:46 GMT"; size=4485; name="source"

The header_elements function in httputil was splitting this header on
comma, without respect of the quotes. This lead to the name being skipped.
As the part had no name, it was not added to entity params in cpreqbody in
process_multipart_form_data.

The fix is to correctly split the header using a regular expression such
as:

{{{re_header_split = re.compile(',(?=(?:[^"]*"[^"]*")*[^"]*$)')}}}

and then use it like this:

for element in re_header_split.split(fieldvalue):

in httputil.header_elements

Comment (by fumanchu):

Reformatted.