KTOR-1797 Add check for unescaped quote inside quoted header parameter (

#2314)
ktorio · Jan 22, 2021 · f776d7c · f776d7c
1 parent 89c627a
commit f776d7c
Show file tree

Hide file tree

Showing 2 changed files with 62 additions and 1 deletion.
diff --git a/ktor-http/common/src/io/ktor/http/HeaderValueWithParameters.kt b/ktor-http/common/src/io/ktor/http/HeaderValueWithParameters.kt
@@ -93,7 +93,35 @@ private fun String.checkNeedEscape(): Boolean {
     return false
 }
 
-private fun String.isQuoted(): Boolean = length > 1 && first() == '\"' && last() == '\"'
+private fun String.isQuoted(): Boolean {
+    if (length < 2) {
+        return false
+    }
+    if (first() != '"' || last() != '"') {
+        return false
+    }
+    var startIndex = 1
+    do {
+        val index = indexOf('"', startIndex)
+        if (index == lastIndex) {
+            break
+        }
+
+        var slashesCount = 0
+        var slashIndex = index - 1
+        while (this[slashIndex] == '\\') {
+            slashesCount++
+            slashIndex--
+        }
+        if (slashesCount % 2 == 0) {
+            return false
+        }
+
+        startIndex = index + 1
+    } while (startIndex < length)
+
+    return true
+}
 
 /**
  * Escape string using double quotes

diff --git a/ktor-http/common/test/io/ktor/tests/http/HeadersTest.kt b/ktor-http/common/test/io/ktor/tests/http/HeadersTest.kt
@@ -245,6 +245,39 @@ class HeadersTest {
         }
     }
 
+    @Test
+    fun testRenderQuotesIfHasUnescapedQuotes() {
+        // first
+        assertEquals(
+            """file; k="\"\"vv\""""",
+            ContentDisposition.File.withParameter("k", """""vv"""").toString()
+        )
+        // middle
+        assertEquals(
+            """file; k="\"v\"v\""""",
+            ContentDisposition.File.withParameter("k", """"v"v"""").toString()
+        )
+        // last
+        assertEquals(
+            """file; k="\"vv\"\""""",
+            ContentDisposition.File.withParameter("k", """"vv""""").toString()
+        )
+        // escaped slash
+        assertEquals(
+            """file; k="\"v\\\\\"v\""""",
+            ContentDisposition.File.withParameter("k", """"v\\"v"""").toString()
+        )
+    }
+
+    @Test
+    fun testDoesNotRenderQuotesIfHasEscapedQuotes() {
+        // middle
+        assertEquals(
+            """file; k="v\"v"""",
+            ContentDisposition.File.withParameter("k", """"v\"v"""").toString()
+        )
+    }
+
     @Test
     fun headersOfShouldBeCaseInsensitive() {
         val value = "world"