fix(core): validate disposition tokens (#16)

Author: ubugeeei

crates/fastmulp_core/src/content_disposition/mod.rs

@@ -126,10 +126,38 @@ fn parse_parameter_value<'a>(
             offset: offset + start,
         });
     }
+    if !token.iter().copied().all(is_tchar) {
+        return Err(Error::InvalidContentDisposition {
+            offset: offset + start,
+        });
+    }
 
     Ok((TextValue::Borrowed(token), cursor))
 }
 
+fn is_tchar(byte: u8) -> bool {
+    matches!(
+        byte,
+        b'!' | b'#'
+            | b'$'
+            | b'%'
+            | b'&'
+            | b'\''
+            | b'*'
+            | b'+'
+            | b'-'
+            | b'.'
+            | b'^'
+            | b'_'
+            | b'`'
+            | b'|'
+            | b'~'
+            | b'0'..=b'9'
+            | b'A'..=b'Z'
+            | b'a'..=b'z'
+    )
+}
+
 fn parse_quoted_value<'a>(
     value: &'a [u8],
     start: usize,

crates/fastmulp_core/tests/spec_invalid.rs

@@ -1,5 +1,16 @@
 use fastmulp_core::{Boundary, Error, parse};
 
+fn assert_invalid_content_disposition(disposition: &str) {
+  let body = format!(
+    "--abc123\r\nContent-Disposition: {disposition}\r\n\r\npayload\r\n--abc123--\r\n"
+  );
+
+  assert!(matches!(
+    parse(body.as_bytes(), b"abc123"),
+    Err(Error::InvalidContentDisposition { .. })
+  ));
+}
+
 #[test]
 fn rejects_missing_content_disposition() {
   let body = concat!(
@@ -32,6 +43,33 @@ fn rejects_missing_name_parameter() {
   ));
 }
 
+#[test]
+fn rejects_unquoted_content_disposition_parameter_values_with_whitespace() {
+  for disposition in [
+    "form-data; name=field value",
+    "form-data; name=field\tvalue",
+    "form-data; name=field value; filename=blob.txt",
+  ] {
+    assert_invalid_content_disposition(disposition);
+  }
+}
+
+#[test]
+fn rejects_unquoted_content_disposition_parameter_values_with_separators() {
+  for disposition in [
+    "form-data; name=field\"value",
+    "form-data; name=field,value",
+    "form-data; name=field:value",
+    "form-data; name=field/value",
+    "form-data; name=field(value)",
+    "form-data; name=field[value]",
+    "form-data; name=field{value}",
+    "form-data; name=field;value",
+  ] {
+    assert_invalid_content_disposition(disposition);
+  }
+}
+
 #[test]
 fn rejects_header_continuation() {
   let body = concat!(
@@ -143,4 +181,3 @@ fn rejects_non_form_data_disposition() {
     Err(Error::InvalidContentDisposition { .. })
   ));
 }
-