Skip to content

quote_token leaves an empty parameter value unquoted, producing invalid "name=" headers #1696

Open

Description

@NickIvanter

mail 2.9.1, same code on master.

part = Mail::Part.new("Content-Type: image/png; name=\"\"\r\n\r\nx")
part.header[:content_type].decoded  # => "image/png; name="
part.header[:content_type].encoded  # => "Content-Type: image/png;\r\n name=\r\n"

Expected: name="" in the encoded header. Per RFC 2045 section 5.1 a parameter value is a token (one or more characters) or a quoted-string, so an empty value has to be quoted.

Mail::Utilities.quote_token("") returns an empty string because TOKEN_UNSAFE does not match an empty string; ParameterHash#encoded and #decoded use it for every parameter.

Impact: Mail.ru sends pasted images as Content-Type: image/png; name="". Helpdesk software that re-sends such parts (Zammad agent notifications) produces name=, and SMTP servers reject these messages, e.g. 554 Transaction failed: In parameter list <;0x000d0x000a name=>, expected parameter value, got "null".

Possible fix: quote empty values in ParameterHash#encoded. Doing it in quote_token would also change #decoded to name="", and downstream parsers read decoded values: Zammad, for one, would then name such attachments "".

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions