emersion / emersion/go-message

broken e-mail: space in unescaped filename param of Content-Disposition header

Open
#184 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
458
Forks
129
PR merge metrics
No merged PRs in 30d

Description

I came across a broken e-mail that has a space in the filename parameters of a Content-Disposition header, like this:
`Content-Disposition: inline; filename=Concur _1_.png`

Now, this is not valid per https://www.rfc-editor.org/rfc/rfc2183.html#section-2 and https://www.rfc-editor.org/rfc/rfc2045#section-5.1, no space is allowed unless the filename is quoted, which it was not.

I'm filing this issue merely to document how this breaks, not with the expectation that a simple fix is possible:
- I'm saw this in [aerc](https://git.sr.ht/~rjarry/aerc), which uses go-message [ContentDisposition()](https://github.com/emersion/go-message/blob/acf41e649f9a454bf1c7131a62f2f470f2b3542f/header.go#L79), which uses [parseHeaderWithParams()](https://github.com/emersion/go-message/blob/acf41e649f9a454bf1c7131a62f2f470f2b3542f/header.go#L9), which uses the go mime library.
- The go mime library throws a [ErrInvalidMediaParameter](https://cs.opensource.google/go/go/+/refs/tags/go1.23.0:src/mime/mediatype.go;drc=b0b1d42db32a992150dd26681d3bda222e108303;l=127) at https://cs.opensource.google/go/go/+/refs/tags/go1.23.0:src/mime/mediatype.go;drc=b0b1d42db32a992150dd26681d3bda222e108303;l=169

Thunderbird seems to be able to deal with this brokenness, I have not checked how they do this.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.