[PATCH http-server 1/2] fix #6887: apiserver: accept quoted multipart boundary

[Michal Fox <me@dualfroz.com>]

RFC 2046 allows the boundary parameter of a multipart Content-Type to
be a quoted-string, and even requires it if the boundary contains
characters like a colon. RFC 7578 notes that quoting it is often
necessary for multipart/form-data.

parse_content_type() took everything after the equal sign verbatim, so
for 'boundary="foo"' the quotes became part of the boundary. The
delimiter lines of the body, correctly written as '--foo', never
matched and the upload failed.

Strip the quotes of a quoted boundary.

Signed-off-by: Michal Fox <me@dualfroz.com>
---
 src/PVE/APIServer/AnyEvent.pm | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/PVE/APIServer/AnyEvent.pm b/src/PVE/APIServer/AnyEvent.pm
index 915d678..bb49a8f 100644
--- a/src/PVE/APIServer/AnyEvent.pm
+++ b/src/PVE/APIServer/AnyEvent.pm
@@ -1382,8 +1382,9 @@ sub parse_content_type {
     my ($ct, @params) = split(/\s*[;,]\s*/o, $ctype);
 
     foreach my $v (@params) {
-        if ($v =~ m/^\s*boundary\s*=\s*(\S+?)\s*$/o) {
-            return wantarray ? ($ct, $1) : $ct;
+        # the boundary may be given as quoted-string, see RFC 2046, section 5.1.1
+        if ($v =~ m/^\s*boundary\s*=\s*(?:"([^"]+)"|(\S+?))\s*$/o) {
+            return wantarray ? ($ct, $1 // $2) : $ct;
         }
     }
 
-- 
2.43.0