Parse Content-Disposition header as user input

[bitterpanda63]

No description provided.

[aikido-pr-checks]

Public record ParseResult exposes a mutable Map 'params' (HashMap) allowing unsynchronized concurrent mutation.

Details

✨ AI Reasoning
​​1) The new code defines a public record ParseResult that carries a Map<String,String> params which is the mutable HashMap created in parse(); 2) Exposing a mutable map from a public API allows callers to share and mutate the same Map across threads without synchronization, creating potential data races and non-deterministic behaviour; 3) This is a thread-safety risk introduced by the new ParseResult API because the Map is not wrapped immutable or defensively copied before being exposed.

🔧 How do I fix it?
Use locks, concurrent collections, or atomic operations when accessing shared mutable state. Avoid modifying collections during iteration. Use proper synchronization primitives like mutex, lock, or thread-safe data structures.

_{More info - Comment @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}

[codecov]

Codecov Report

❌ Patch coverage is 86.66667% with 10 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...do/agent_api/helpers/ContentDispositionHeader.java	89.83%	3 Missing and 3 partials ⚠️
.../agent_api/helpers/ContentDispositionFilename.java	66.66%	2 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!

[bitterpanda63]

Closing: this never made any sense, would be a header you send out, not one you receive, the protections work for file uploads