Incorrectly formatted Content-Disposition headers may cause error.

[Tom Christie]

MultiPartParser does not handle malformed Content-Disposition headers gracefully in some cases. If the client uses filename*= syntax, but omits the language enclosed in single quotes, then an error will be raised instead of gracefully ignoring the component.

This is introduced by the fix in https://code.djangoproject.com/ticket/22971

Here we split the header without checking if the split length is correct...

​https://github.com/django/django/blob/1.8a1/django/http/multipartparser.py#L649

The has_encoding test should probably be...

if name.endswith('*') and p[i + 1:].count("'") == 2

[Claude Paroz]

Sure. Do you have by chance a "real world" failing example?

[Tom Christie]

I believe omitting the quotes for the language would cause a 500.
Eg. this would work

Content-Disposition: attachment; filename*=UTF-8'en-us'filename.txt

But this would raise a 500. (If that was in the form of say, a MultiPartParseError that'd be perfectly acceptable of course. It's just the unguarded 500 that's slightly non-ideal)

Content-Disposition: attachment; filename*=UTF-8"en-us"filename.txt

[Claude Paroz]

Raùl provided a patch (​https://github.com/django/django/pull/3983). Tom, could you check if it looks ok for you?

[Tom Christie]

Yup that looks correct.

[Claude Paroz <claude@…>]

In ac650d02cbb66ab652ae529b8f03b486ef974dfb:

Fixed #24209 -- Prevented crash when parsing malformed RFC 2231 headers

Thanks Tom Christie for the report and review.

[Claude Paroz <claude@…>]

In 7cc1b4710ea3fbe3a076d14f9265f115a615964a:

[1.8.x] Fixed #24209 -- Prevented crash when parsing malformed RFC 2231 headers

Thanks Tom Christie for the report and review.
Backport of ac650d02cb from master.