Ignore Content-Type parameters for part metadata without quirks (#52)

The vintage multipart decoder stored every Content-Type parameter in
currentFieldAttributes under its own name. A parameter named name,
filename or content-length therefore replaced the value from
Content-Disposition or Content-Length, changing the field name or upload
filename, turning a plain field into a FileUpload, or changing the part
length.

Legacy Netty behaves the same way, so this is kept when
LEGACY_HEADER_SPLITTING is enabled. Without the quirk, only the type
itself and the charset parameter of Content-Type are used; other
parameters and stray tokens after the type are ignored.

Fixes #48

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: yawkat

multipart-core/src/main/java/io/netty/contrib/multipart/DecoderQuirk.java

@@ -41,6 +41,10 @@ public enum DecoderQuirk {
      * The modern parser uses structured parsing for {@code Content-Type} parameters, but the legacy decoder exposes
      * raw tokens. Enabling this quirk switches to the legacy split and fills the {@code quirkHeader} array so the
      * vintage wrapper can continue consuming headers exactly like before.
+     * <p>
+     * With this quirk, the vintage multipart decoder also stores {@code Content-Type} parameters such as {@code name},
+     * {@code filename} and {@code content-length} as part metadata, overriding the values from
+     * {@code Content-Disposition} and {@code Content-Length}, matching legacy Netty.
      */
     LEGACY_HEADER_SPLITTING,
 

multipart-vintage/src/main/java/io/netty/contrib/multipart/vintage/HttpPostMultipartRequestDecoder.java

@@ -652,6 +652,10 @@ private boolean handleHeader(String[] contents) {
                     throw new ErrorDataDecoderException("Mixed Multipart found in a previous Mixed Multipart");
                 }
             } else {
+                // Legacy decoders stored every Content-Type parameter under its own name, so parameters such as
+                // name, filename or content-length would overwrite the part metadata. Without the quirk, only the
+                // type itself and the charset parameter are used.
+                boolean legacyParameters = decoder.hasQuirk(DecoderQuirk.LEGACY_HEADER_SPLITTING);
                 for (int i = 1; i < contents.length; i++) {
                     final String charsetHeader = HttpHeaderValues.CHARSET.toString();
                     if (contents[i].regionMatches(true, 0, charsetHeader, 0, charsetHeader.length())) {
@@ -666,7 +670,10 @@ private boolean handleHeader(String[] contents) {
                             throw new ErrorDataDecoderException(e);
                         }
                         putCurrentFieldAttribute(HttpHeaderValues.CHARSET, attribute);
-                    } else if (contents[i].contains("=")) {
+                    } else if (!legacyParameters && i > 1) {
+                        // Other parameters (and stray tokens after the type) do not affect the part.
+                        continue;
+                    } else if (legacyParameters && contents[i].contains("=")) {
                         String name = StringUtil.substringBefore(contents[i], '=');
                         String values = StringUtil.substringAfter(contents[i], '=');
                         Attribute attribute;

multipart-vintage/src/test/java/io/netty/contrib/multipart/vintage/MultipartQuirksVintageTest.java

@@ -23,17 +23,22 @@
 import io.netty.handler.codec.http.HttpHeaderValues;
 import io.netty.handler.codec.http.HttpMethod;
 import io.netty.handler.codec.http.HttpVersion;
+import io.netty.handler.codec.http.multipart.Attribute;
 import io.netty.handler.codec.http.multipart.DefaultHttpDataFactory;
+import io.netty.handler.codec.http.multipart.FileUpload;
 import io.netty.handler.codec.http.multipart.HttpDataFactory;
+import io.netty.handler.codec.http.multipart.InterfaceHttpData;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedClass;
 import org.junit.jupiter.params.provider.ValueSource;
 
+import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
 
 @ParameterizedClass
 @ValueSource(booleans = {false, true})
@@ -78,4 +83,88 @@ void useFieldCharsetForDelimiterSearch() {
             decoder.destroy();
         }
     }
+
+    private HttpPostRequestDecoder legacyHeaderSplittingDecoder(String body) {
+        HttpPostRequestDecoder.Builder builder = HttpPostRequestDecoder.builder().dataFactory(dataFactory);
+        if (quirk) {
+            builder.enableQuirks(DecoderQuirk.LEGACY_HEADER_SPLITTING);
+        }
+        return builder.build(fullRequest("a", body));
+    }
+
+    @Test
+    void contentTypeNameParameterDoesNotOverrideFieldName() {
+        HttpPostRequestDecoder decoder = legacyHeaderSplittingDecoder("--a\r\n" +
+                "Content-Disposition: form-data; name=\"file\"; filename=\"real.pdf\"\r\n" +
+                "Content-Type: application/pdf; name=\"x.pdf\"\r\n" +
+                "\r\n" +
+                "v\r\n" +
+                "--a--\r\n");
+        try {
+            FileUpload upload = assertInstanceOf(FileUpload.class, decoder.getBodyHttpDatas().get(0));
+            assertEquals(quirk ? "x.pdf" : "file", upload.getName());
+            assertEquals("real.pdf", upload.getFilename());
+            assertEquals("application/pdf", upload.getContentType());
+        } finally {
+            decoder.destroy();
+        }
+    }
+
+    @Test
+    void contentTypeFilenameParameterDoesNotOverrideFilename() {
+        HttpPostRequestDecoder decoder = legacyHeaderSplittingDecoder("--a\r\n" +
+                "Content-Disposition: form-data; name=\"file\"; filename=\"real.pdf\"\r\n" +
+                "Content-Type: application/pdf; filename=\"x.pdf\"\r\n" +
+                "\r\n" +
+                "v\r\n" +
+                "--a--\r\n");
+        try {
+            FileUpload upload = assertInstanceOf(FileUpload.class, decoder.getBodyHttpDatas().get(0));
+            assertEquals("file", upload.getName());
+            assertEquals(quirk ? "x.pdf" : "real.pdf", upload.getFilename());
+        } finally {
+            decoder.destroy();
+        }
+    }
+
+    @Test
+    void contentTypeFilenameParameterDoesNotTurnFieldIntoFileUpload() throws IOException {
+        HttpPostRequestDecoder decoder = legacyHeaderSplittingDecoder("--a\r\n" +
+                "Content-Disposition: form-data; name=\"field\"\r\n" +
+                "Content-Type: text/plain; filename=\"x.pdf\"; charset=UTF-8\r\n" +
+                "\r\n" +
+                "v\r\n" +
+                "--a--\r\n");
+        try {
+            InterfaceHttpData data = decoder.getBodyHttpDatas().get(0);
+            assertEquals("field", data.getName());
+            if (quirk) {
+                assertEquals("x.pdf", assertInstanceOf(FileUpload.class, data).getFilename());
+            } else {
+                Attribute attribute = assertInstanceOf(Attribute.class, data);
+                assertEquals("v", attribute.getValue());
+                assertEquals(StandardCharsets.UTF_8, attribute.getCharset());
+            }
+        } finally {
+            decoder.destroy();
+        }
+    }
+
+    @Test
+    void contentTypeContentLengthParameterDoesNotOverrideLength() throws IOException {
+        HttpPostRequestDecoder decoder = legacyHeaderSplittingDecoder("--a\r\n" +
+                "Content-Disposition: form-data; name=\"field\"\r\n" +
+                "Content-Type: text/plain; content-length=100\r\n" +
+                "\r\n" +
+                "value\r\n" +
+                "--a--\r\n");
+        try {
+            Attribute attribute = assertInstanceOf(Attribute.class, decoder.getBodyHttpDatas().get(0));
+            assertEquals("field", attribute.getName());
+            assertEquals("value", attribute.getValue());
+            assertEquals(quirk ? 100 : 0, attribute.definedLength());
+        } finally {
+            decoder.destroy();
+        }
+    }
 }