httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Gareth McCaughan <>
Subject Re: mod_mbox: incorrect parsing of MIME part-names
Date Fri, 02 Jun 2006 15:29:21 GMT
On Friday 2006-06-02 16:14, Maxime Petazzoni wrote:

> >   - Isolated double-quotes aren't escaped in any way.
> >     There's no clearly-correct way to deal with them,
> >     I think, but leaving them as they are means that
> >     the problem that prompted me to write this has only
> >     been lessened, not entirely fixed. This is a
> >     deficiency. Fixing it would substantially complicate
> >     the code. Kludging it, for instance by a second pass
> >     that simply annihilates double-quotes, would be
> >     pretty easy but arguably the Wrong Thing.

> This would be pretty hard to parse properly anyway. Although it should
> be the job of the MUA to escape those quotes and encapsulate the whole
> filename in double-quotes, I've seen so many d***ss mailers while
> working on the multipart decoding that we can't rely on them :)

Right. :-)

> >   - Escaped characters are left escaped. This is probably
> >     a deficiency, but a minor one.
> Aren't they supposed to remain escaped ? If they're unescaped, won't
> they hurt the AJAX interface too ?

The mechanism for escaping characters in XML attribute values
isn't the same as the mechanism for escaping characters in
MIME parameter values. The XML way is to replace the offending
characters with entities (&#34; or whatever), and the MIME way
is to backslash them. Unfortunately, escaping XML-style can
make the string longer, which is the reason why a lazy
quick-and-dirty patch like mine doesn't do it :-).

> That's a good patch, and working. Thanks for your work and for making
> it neat.

You're welcome.


Speaking of mod_mbox problems, the dev@ archives at
(which are managed by mod_mbox) seem to be some way behind the
times. Gmane shows 20 messages already in June, whereas the official
archives have only 8. Perhaps it's just that the archives are
only updated daily; if not, something may be amiss. I expect this
is the wrong place to report the problem (if it *is* a problem),


View raw message