diff --git a/src/PVE/APIServer/AnyEvent.pm b/src/PVE/APIServer/AnyEvent.pm index f4ee9f2..915d678 100644 --- a/src/PVE/APIServer/AnyEvent.pm +++ b/src/PVE/APIServer/AnyEvent.pm @@ -1303,9 +1303,8 @@ sub file_upload_multipart { my $extract_form_disposition = sub { my ($name) = @_; - # parameter values can be a token or a quoted-string, see RFC 7578, section 4.2 if ($hdl->{rbuf} =~ - s/^${delim_re}.*?Content-Disposition: (.*?); name=(?:"\Q$name\E"|\Q$name\E(?=[;\s]))(.*?${delim_re})/$2/s + s/^${delim_re}.*?Content-Disposition: (.*?); name="$name"(.*?${delim_re})/$2/s ) { assert_form_disposition($1); $remove_until_data->($hdl); @@ -1320,14 +1319,13 @@ sub file_upload_multipart { $extract_form_disposition->('checksum'); if ($hdl->{rbuf} =~ - s/^${delim_re}Content-Disposition: (.*?); name=(?:"(.*?)"|([^\s;"]+)); filename=(?:"([^"]+)"|([^\s;"]+))//s + s/^${delim_re}Content-Disposition: (.*?); name="(.*?)"; filename="([^"]+)"//s ) { - my ($disposition, $field, $filename) = ($1, $2 // $3, $4 // $5); - assert_form_disposition($disposition); - die "wrong field name '$field' for file upload, expected 'filename'" - if $field ne "filename"; + assert_form_disposition($1); + die "wrong field name '$2' for file upload, expected 'filename'" + if $2 ne "filename"; $rstate->{phase} = 2; - $rstate->{params}->{filename} = trim($filename); + $rstate->{params}->{filename} = trim($3); $remove_until_data->($hdl); # any remaining multipart "headers" like Content-Type } } @@ -1384,9 +1382,8 @@ sub parse_content_type { my ($ct, @params) = split(/\s*[;,]\s*/o, $ctype); foreach my $v (@params) { - # the boundary may be given as quoted-string, see RFC 2046, section 5.1.1 - if ($v =~ m/^\s*boundary\s*=\s*(?:"([^"]+)"|(\S+?))\s*$/o) { - return wantarray ? ($ct, $1 // $2) : $ct; + if ($v =~ m/^\s*boundary\s*=\s*(\S+?)\s*$/o) { + return wantarray ? ($ct, $1) : $ct; } }