id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
29402	parse_header function in http/multipartparser.py unescapes in wrong order	Martin Dickopp	nobody	"Found by code review: It seems the parse_header function in http/multipartparser.py unescapes values in the wrong order:

{{{
value = value.replace(b'\\\\', b'\\').replace(b'\\""', b'""')
}}}

If {{{\\}}} is unescaped before {{{\""}}}, the sequence {{{\\""}}} will be unescaped to {{{\""}}} by the first replace function and unescaped again to {{{""}}} by the second replace function. This could be avoided by exchanging the replace functions:

{{{
value = value.replace(b'\\""', b'""').replace(b'\\\\', b'\\')
}}}
"	Bug	closed	HTTP handling	dev	Normal	needsinfo			Unreviewed	0	0	0	0	0	0