Bug 685192 - In RFC2231/5987 encoding, a missing charset field should be treated as error; r=bz

netwerk/mime/nsMIMEHeaderParamImpl.cpp

@@ -377,12 +377,19 @@ nsMIMEHeaderParamImpl::DoParameterInternal(const char *aHeaderValue,
           goto increment_str;
         }
 
-        if (aCharset && sQuote1 > valueStart && sQuote1 < valueEnd)
-        {
+        // charset part is required
+        if (! (sQuote1 > valueStart && sQuote1 < valueEnd)) {
+          // log the warning and skip to next parameter
+          NS_WARNING("Mandatory charset part missing in header parameter, parameter ignored\n");
+          goto increment_str;
+        }
+        
+        if (aCharset) {
           *aCharset = (char *) nsMemory::Clone(valueStart, sQuote1 - valueStart + 1);
           if (*aCharset) 
             *(*aCharset + (sQuote1 - valueStart)) = 0;
         }
+        
         if (aLang && sQuote2 > sQuote1 + 1 && sQuote2 < valueEnd)
         {
           *aLang = (char *) nsMemory::Clone(sQuote1 + 1, sQuote2 - (sQuote1 + 1) + 1);

netwerk/test/unit/test_MIME_params.js

@@ -252,6 +252,17 @@ var tests = [
   ["attachment; filename = foo-A.html", 
    "attachment", "foo-A.html"],   
 
+  // Bug 685192: in RFC2231/5987 encoding, a missing charset field should be
+  // treated as error 
+
+  // the actual bug
+  ["attachment; filename*=''foo", 
+   "attachment", Cr.NS_ERROR_INVALID_ARG],      
+
+  // sanity check
+  ["attachment; filename*=a''foo", 
+   "attachment", "foo"],      
+
   // Bug 692574: RFC2231/5987 decoding should not tolerate missing single
   // quotes