Skip to content

Commit c07d658

Browse files
hsbtclaude
andcommitted
Coerce multipart content type to a string before validating
The CR/LF check via Regexp#match? requires a String, but the per-part content type was previously interpolated through to_s and accepted any object such as a Symbol. Coerce it first to keep that behavior. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 parent 02a962f commit c07d658

2 files changed

Lines changed: 4 additions & 1 deletion

File tree

lib/net/http/generic_request.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -349,7 +349,7 @@ def encode_multipart_form_data(out, params, opt)
349349
buf << "--#{boundary}\r\n"
350350
if filename
351351
filename = quote_string(filename, charset)
352-
type = h[:content_type] || 'application/octet-stream'
352+
type = (h[:content_type] || 'application/octet-stream').to_s
353353
if /[\r\n]/.match?(type)
354354
raise ArgumentError, "field content type cannot include CR/LF"
355355
end

test/net/http/test_http.rb

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -944,6 +944,9 @@ def test_set_form_multipart_crlf_injection
944944
assert_raise(ArgumentError) do
945945
build.call([['f', 'v', {filename: 'a', content_type: "text/plain\r\nX-Injected: 1"}]])
946946
end
947+
assert_nothing_raised do
948+
build.call([['f', 'v', {filename: 'a', content_type: :"text/plain"}]])
949+
end
947950
end
948951
end
949952

0 commit comments

Comments
 (0)