Add support for the extended header parameter syntax in Content-Disposition h...

net/base/net_util.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/net_util.h"
 
 #include <algorithm>
 #include <map>
 #include <unicode/regex.h>
 #include <unicode/ucnv.h>
@@ skipping 351 matching lines @@
     }
     // encoded_word ending prematurelly with '?' or extra '?'
     *is_rfc2047 = false;
     return false;
   }
 
   // We're not handling 'especial' characters quoted with '\', but
   // it should be Ok because we're not an email client but a
   // web browser.
 
-  // What IE6/7 does: %-escaped UTF-8. We could extend this to
-  // support a rudimentary form of RFC 2231 with charset label, but
-  // it'd gain us little in terms of compatibility.
+  // What IE6/7 does: %-escaped UTF-8.
   tmp = UnescapeURLComponent(encoded_word, UnescapeRule::SPACES);
   if (IsStringUTF8(tmp)) {
     output->swap(tmp);
     return true;
     // We can try either the OS default charset or 'origin charset' here,
     // As far as I can tell, IE does not support it. However, I've seen
     // web servers emit %-escaped string in a legacy encoding (usually
     // origin charset).
     // TODO(jungshik) : Test IE further and consider adding a fallback here.
   }
@@ skipping 28 matching lines @@
       return false;
     tmp.append(decoded);
   }
   output->swap(tmp);
   return true;
 }
 
 // TODO(mpcomplete): This is a quick and dirty implementation for now.  I'm
 // sure this doesn't properly handle all (most?) cases.
 template<typename STR>
-STR GetHeaderParamValueT(const STR& header, const STR& param_name) {
+STR GetHeaderParamValueT(const STR& header, const STR& param_name,
+                         QuoteRule::Type quote_rule) {
   // This assumes args are formatted exactly like "bla; arg1=value; arg2=value".
   typename STR::const_iterator param_begin =
       search(header.begin(), header.end(), param_name.begin(), param_name.end(),
              CaseInsensitiveCompareASCII<typename STR::value_type>());
 
   if (param_begin == header.end())
     return STR();
   param_begin += param_name.length();
 
   STR whitespace;
   whitespace.push_back(' ');
   whitespace.push_back('\t');
   const typename STR::size_type equals_offset =
       header.find_first_not_of(whitespace, param_begin - header.begin());
   if (equals_offset == STR::npos || header.at(equals_offset) != '=')
     return STR();
 
   param_begin = header.begin() + equals_offset + 1;
   if (param_begin == header.end())
     return STR();
 
   typename STR::const_iterator param_end;
-  if (*param_begin == '"') {
+  if (*param_begin == '"' && quote_rule == QuoteRule::REMOVE_OUTER_QUOTES) {
     param_end = find(param_begin+1, header.end(), '"');
     if (param_end == header.end())
       return STR();  // poorly formatted param?
 
     ++param_begin;  // skip past the quote.
   } else {
     param_end = find(param_begin+1, header.end(), ';');
   }
 
   return STR(param_begin, param_end);
@@ skipping 627 matching lines @@
 std::wstring GetSpecificHeader(const std::wstring& headers,
                                const std::wstring& name) {
   return GetSpecificHeaderT(headers, name);
 }
 
 std::string GetSpecificHeader(const std::string& headers,
                                const std::string& name) {
   return GetSpecificHeaderT(headers, name);
 }
 
+bool DecodeCharset(const std::string& input,
+                   std::string* decoded_charset,
+                   std::string* value) {
+  StringTokenizer t(input, "'");
+  t.set_options(StringTokenizer::RETURN_DELIMS);
+  std::string temp_charset;
+  std::string temp_value;
+  int numDelimsSeen = 0;
+  while (t.GetNext()) {
+    if (t.token_is_delim()) {
+      ++numDelimsSeen;
+      continue;
+    } else {
+      switch (numDelimsSeen) {
+        case 0:
+          temp_charset = t.token();
+          break;
+        case 1:
+          // Language is ignored.
+          break;
+        case 2:
+          temp_value = t.token();
+          break;
+        default:
+          return false;
+      }
+    }
+  }
+  if (numDelimsSeen != 2)
+    return false;
+  if (temp_charset.empty() || temp_value.empty())
+    return false;
+  decoded_charset->swap(temp_charset);
+  value->swap(temp_value);
+  return true;
+}
+
 std::string GetFileNameFromCD(const std::string& header,
                               const std::string& referrer_charset) {
-  std::string param_value = GetHeaderParamValue(header, "filename");
+  std::string decoded;
+  std::string param_value = GetHeaderParamValue(header, "filename*",
+                                                QuoteRule::KEEP_OUTER_QUOTES);
+  if (!param_value.empty()) {
+    if (param_value.find('"') == std::string::npos) {
+      std::string charset;
+      std::string value;
+      if (DecodeCharset(param_value, &charset, &value)) {
+        // RFC 5987 value should be ASCII-only.
+        if (!IsStringASCII(value))
+          return std::string();
+        std::string tmp = UnescapeURLComponent(value, UnescapeRule::SPACES);
+        if (base::ConvertToUtf8AndNormalize(tmp, charset, &decoded))
+          return decoded;
+      }
+    }
+  }
+  param_value = GetHeaderParamValue(header, "filename",
+                                    QuoteRule::REMOVE_OUTER_QUOTES);
   if (param_value.empty()) {
     // Some servers use 'name' parameter.
-    param_value = GetHeaderParamValue(header, "name");
+    param_value = GetHeaderParamValue(header, "name",
+                                      QuoteRule::REMOVE_OUTER_QUOTES);
   }
   if (param_value.empty())
     return std::string();
-  std::string decoded;
   if (DecodeParamValue(param_value, referrer_charset, &decoded))
     return decoded;
   return std::string();
 }
 
 std::wstring GetHeaderParamValue(const std::wstring& field,
-                                 const std::wstring& param_name) {
-  return GetHeaderParamValueT(field, param_name);
+                                 const std::wstring& param_name,
+                                 QuoteRule::Type quote_rule) {
+  return GetHeaderParamValueT(field, param_name, quote_rule);
 }
 
 std::string GetHeaderParamValue(const std::string& field,
-                                const std::string& param_name) {
-  return GetHeaderParamValueT(field, param_name);
+                                const std::string& param_name,
+                                QuoteRule::Type quote_rule) {
+  return GetHeaderParamValueT(field, param_name, quote_rule);
 }
 
 // TODO(brettw) bug 734373: check the scripts for each host component and
 // don't un-IDN-ize if there is more than one. Alternatively, only IDN for
 // scripts that the user has installed. For now, just put the entire
 // path through IDN. Maybe this feature can be implemented in ICU itself?
 //
 // We may want to skip this step in the case of file URLs to allow unicode
 // UNC hostnames regardless of encodings.
 std::wstring IDNToUnicode(const char* host,
@@ skipping 863 matching lines @@
 }
 
 int GetPortFromAddrinfo(const struct addrinfo* info) {
   uint16* port_field = GetPortFieldFromAddrinfo(info);
   if (!port_field)
     return -1;
   return ntohs(*port_field);
 }
 
 }  // namespace net