Reject MIME type parameters differing only in case#37008
Open
junhyeong9812 wants to merge 1 commit into
Open
Conversation
MIME type parameter names are case-insensitive, but the duplicate parameter check added in spring-projectsgh-36841 accumulated parameters in a case-sensitive map. As a result, duplicates differing only in case (such as "charset" and "CHARSET") were not rejected and were silently collapsed to the last value. Accumulate parameters in a LinkedCaseInsensitiveMap so that such duplicates map to the same key and are rejected consistently, matching the case-insensitive map already used by MimeType for parameter storage. Signed-off-by: junhyeong9812 <pickjog@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
MimeTypeUtilsrejects duplicate MIME type parameters (gh-36841), but the check is case-sensitive while MIME parameter names are case-insensitive. As a result, duplicates that differ only in case (for examplecharsetandCHARSET) slip through and are silently collapsed to the last value. This aligns the duplicate check with the case-insensitive nature of parameter names.Problem
When parsing parameters,
MimeTypeUtils.parseMimeTypeInternal(...)accumulates them in aLinkedHashMap, and gh-36841 added a duplicate check by throwing whenMap#putreturns a previous value:Because a
LinkedHashMaptreatscharsetandCHARSETas distinct keys, a case-variant duplicate never triggers the check:text/plain;dupe="1";dupe="2"InvalidMimeTypeException)text/plain;dupe="1";DUPE="2""2"This is inconsistent: MIME parameter names are case-insensitive (RFC 2045), and
MimeTypeitself stores parameters in aLinkedCaseInsensitiveMapso thatgetParameter("CHARSET")andgetParameter("charset")resolve to the same value. RFC 6838 section 4.3 (cited by gh-36841) treats duplicate parameters as an error, so a case-only variant is logically the same duplicate.Fix
Accumulate parameters in a
LinkedCaseInsensitiveMapso that a case-variant duplicate maps to the same key, causingputto return the previous value and the existing check to reject it:Locale.ROOTmatches howMimeTypebuilds its own parameter map, keeping case-insensitive comparison locale-independent. The finalMimeTypeis unaffected: its constructor re-copies the parameters into its ownLinkedCaseInsensitiveMap, and for non-duplicate input the accumulating map behaves the same as before (same keys, values, and iteration order). Only the duplicate-detection sensitivity changes.Note on impact
This is a parsing behavior change:
Content-Type/Accept-style strings that repeat a parameter with different casing now throwInvalidMimeTypeExceptioninstead of parsing successfully. This matches the intent of gh-36841 and the case-insensitive contract of parameter names; valid MIME types are unaffected.