Skip to content

Commit 2b4c7d0

Browse files
dobrosibclozel
authored andcommitted
Match ContentDisposition attributes case-insensitively
This commit ensures that `ContentDisposition` parses attributes like "filename" and "filename*" in a case insensitive fashion, per RFC 6266. Closes gh-34383 Signed-off-by: Andras Dobrosi <dobrosi@gmail.com> [brian.clozel@broadcom.com: apply code conventions] Signed-off-by: Brian Clozel <brian.clozel@broadcom.com>
1 parent 6113869 commit 2b4c7d0

File tree

2 files changed

+12
-3
lines changed

2 files changed

+12
-3
lines changed

spring-web/src/main/java/org/springframework/http/ContentDisposition.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2023 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
2525
import java.util.Base64;
2626
import java.util.BitSet;
2727
import java.util.List;
28+
import java.util.Locale;
2829
import java.util.regex.Matcher;
2930
import java.util.regex.Pattern;
3031

@@ -354,7 +355,7 @@ public static ContentDisposition parse(String contentDisposition) {
354355
String part = parts.get(i);
355356
int eqIndex = part.indexOf('=');
356357
if (eqIndex != -1) {
357-
String attribute = part.substring(0, eqIndex);
358+
String attribute = part.substring(0, eqIndex).toLowerCase(Locale.ROOT);
358359
String value = (part.startsWith("\"", eqIndex + 1) && part.endsWith("\"") ?
359360
part.substring(eqIndex + 2, part.length() - 1) :
360361
part.substring(eqIndex + 1));

spring-web/src/test/java/org/springframework/http/ContentDispositionTests.java

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -223,6 +223,14 @@ void parseIgnoresInvalidDates() {
223223
.build());
224224
}
225225

226+
@Test
227+
void parseAttributesCaseInsensitively() {
228+
ContentDisposition cd = ContentDisposition.parse("form-data; Name=\"foo\"; FileName=\"bar.txt\"");
229+
assertThat(cd.getName()).isEqualTo("foo");
230+
assertThat(cd.getFilename()).isEqualTo("bar.txt");
231+
assertThat(cd.toString()).isEqualTo("form-data; name=\"foo\"; filename=\"bar.txt\"");
232+
}
233+
226234
@Test
227235
void parseEmpty() {
228236
assertThatIllegalArgumentException().isThrownBy(() -> parse(""));

0 commit comments

Comments
 (0)