parse_mimetype: skip whitespace-only segments after semicolons

.github/workflows/ci-cd.yml

@@ -75,7 +75,7 @@ jobs:
       with:
         python-version: 3.11
     - name: Cache PyPI
-      uses: actions/cache@v6.1.0
+      uses: actions/cache@v5.0.5
       with:
         key: pip-lint-${{ hashFiles('requirements/*.txt') }}
         path: ~/.cache/pip
@@ -158,7 +158,7 @@ jobs:
       with:
         submodules: true
     - name: Cache llhttp generated files
-      uses: actions/cache@v6.1.0
+      uses: actions/cache@v5.0.5
       id: cache
       with:
         key: llhttp-${{ hashFiles('vendor/llhttp/package*.json', 'vendor/llhttp/src/**/*') }}

CHANGES/13009.bugfix.rst

@@ -0,0 +1 @@
+Fixed :py:meth:`~aiohttp.helpers.parse_mimetype` ignoring whitespace-only segments after semicolons -- by :user:`HrachShah`.

CONTRIBUTORS.txt

@@ -165,6 +165,7 @@ Hans Adema
 Harmon Y.
 Harry Liu
 Hiroshi Ogawa
+Hrach Shahumyan
 Hrishikesh Paranjape
 Hu Bo
 Hugh Young

aiohttp/helpers.py

@@ -332,7 +332,10 @@ def parse_mimetype(mimetype: str) -> MimeType:
     parts = mimetype.split(";")
     params: MultiDict[str] = MultiDict()
     for item in parts[1:]:
-        if not item:
+        # Skip both empty segments (bare trailing semicolon) and
+        # whitespace-only segments (e.g. "text/html; " or "text/html;\t"),
+        # which are not valid MIME parameters per RFC 2045.
+        if not item.strip():
             continue
         key, _, value = item.partition("=")
         params.add(key.lower().strip(), value.strip(' "'))

tests/test_helpers.py

@@ -83,6 +83,34 @@ def test_parse_mimetype(mimetype: str, expected: helpers.MimeType) -> None:
     assert result == expected
 
 
+@pytest.mark.parametrize(
+    "mimetype",
+    [
+        "text/html; ",
+        "text/html;  ",
+        "text/html;\t",
+        "text/html; \t \t",
+        "text/html; charset=utf-8; ",
+        "text/html; charset=utf-8;  \t",
+    ],
+)
+def test_parse_mimetype_skips_whitespace_only_segments(
+    mimetype: str,
+) -> None:
+    """Whitespace-only segments after a semicolon are not valid MIME
+    parameters (RFC 2045) and should be ignored, not parsed as an empty
+    parameter key. Regression test for #13009.
+    """
+    result = helpers.parse_mimetype(mimetype)
+
+    # No spurious empty-key parameter.
+    assert "" not in result.parameters
+    if "charset" in mimetype:
+        assert result.parameters == MultiDictProxy(MultiDict({"charset": "utf-8"}))
+    else:
+        assert result.parameters == MultiDictProxy(MultiDict())
+
+
 # ------------------- parse_content_type ------------------------------