Re: bug report and unit test for infinite loop parsing Content-Disposion header

[Eric Wong <normalperson@yhbt.net>]

Paul Rogers <pmr16366@gmail.com> wrote:
> the regexp in the get_filename method in parser.rb seems to get stuck
> in an infinite loop on   the line with
> 
> if head =~ RFC2183

This is an unfortunate issue of the type of regexp engine used by Ruby

> This happens in the tests as well as in the unit test in the attached
> git commit ( is that the correct term?)

I'm not a regexp/finite-automata expert, but having multiple '*' or
mixing '*'/'+' in a regexp can be problematic.

I think the following should fix your issue (but I'm not sure it's
correct):

diff --git a/lib/rack/multipart.rb b/lib/rack/multipart.rb
index 3777106..6849248 100644
--- a/lib/rack/multipart.rb
+++ b/lib/rack/multipart.rb
@@ -12,7 +12,7 @@ module Rack
     MULTIPART = %r|\Amultipart/.*boundary=\"?([^\";,]+)\"?|n
     TOKEN = /[^\s()<>,;:\\"\/\[\]?=]+/
     CONDISP = /Content-Disposition:\s*#{TOKEN}\s*/i
-    DISPPARM = /;\s*(#{TOKEN})=("(?:\\"|[^"])*"|#{TOKEN})*/
+    DISPPARM = /;\s*(#{TOKEN})=("(?:\\"|[^"])*"|#{TOKEN})/
     RFC2183 = /^#{CONDISP}(#{DISPPARM})+$/i
     BROKEN_QUOTED = /^#{CONDISP}.*;\sfilename="(.*?)"(?:\s*$|\s*;\s*#{TOKEN}=)/i
     BROKEN_UNQUOTED = /^#{CONDISP}.*;\sfilename=(#{TOKEN})/i