Content-Disposition parser doesn't correctly parse unquoted file names
Created by: Emzi0767
This line appears to be responsible for extracting the filename from Content-Disposition
headers. However, it fails if the file name is unquoted, because it gets captured into another regex group.
This behaviour can be tested on regexr, with the filename regex (filename=(?:"([^"]+)"|([^;]+))
) on the following data:
form-data; name="files[]"; filename="1493312718173.png"; filename*=utf-8''1493312718173.png
form-data; name="files[]"; filename=1493312718173.png; filename*=utf-8''1493312718173.png
The first one gets captured into group 1, whereas the second one into group 2, causing the filename detection to fail, despite the regex matching being a success. This can be fixed by replacing filename[1]
with filename[1] || filename[2]
on lines 70-71.