dotnet / dotnet/runtime

Better ContentType.Name validation on composed values

Open
#128,637 1 comment 1 reaction 2 assignees Claimed by @copilot-swe-agent View on GitHub
area-System.Net
Dominant language
C#
Stars
18.3k
Forks
5.6k
PR merge metrics
PR metrics pending

Description

System.Net.Mail.Attachment (and likely AlternateView) has ContentType property which has Name property which itself has validation based on MimeBasePart.DecodeEncoding used in setter, however if encoding is detected at the beginning of string, it do not validate rest of it, allowing to interfere with other parts MailMessage/Attachment/AlternateView. For example, following code sent attachment with name foo.txt instead of test.txt as specified in constructor param.

```csharp
var at = new Attachment("test.txt");
at.ContentType.Name = "=?utf-8?Q?foo\"; filename=\"foo.txt\"";
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.