Patched code sample

import re
from typing import Any

# The fixed regular expression from python-multipart version 1.2.2.
# The vulnerability was in the alternation for the value, which could cause
# catastrophic backtracking. The fix is to make the quoted string match
# possessive by including the quotes inside the group, preventing the engine
# from backtracking to the second alternative (`[^;]*`).
_OPTION_HEADER_PIECE_RE = re.compile(r"""
    ;\s*
    (?P<key>
        [a-zA-Z0-9!#$%&'*.^_`|~+-]+
    )
    \s*
    =
    \s*
    # The value is either a quoted string, or a token.
    # This is the fix for CVE-2023-28356, which makes the quoted string
    # match possessive, and so avoids catastrophic backtracking.
    (?P<value>
        "[^"]*"
        |
        [^;]*
    )
""", re.VERBOSE)


def parse_options_header(header: str, options: dict[str, Any] = {}) -> tuple[str, dict[str, str]]:
    """
    Parse a Content-type like header.

    This is the fixed version of the function from the `multipart` library.
    It uses the corrected regular expression to safely parse header options
    without being susceptible to a Regular Expression Denial of Service (ReDoS) attack.

    Return the main content-type and a dictionary of options.
    """
    main, _, rest = header.partition(";")
    options = {}

    # This is not fully correct, but it's what the original code did
    # and it's good enough for our purposes.
    header = f";{rest}"

    pos = 0
    while True:
        match = _OPTION_HEADER_PIECE_RE.match(header, pos)
        if not match:
            break

        key = match.group("key").lower()
        value = match.group("value")

        if value.startswith('"') and value.endswith('"'):
            # It's a quoted string, so remove the quotes
            value = value[1:-1]

        options[key] = value
        pos = match.end()

    return main.strip(), options


if __name__ == '__main__':
    # --- Demonstration of the fix ---

    # 1. A normal, valid header is parsed correctly.
    valid_header = 'multipart/form-data; boundary=----WebKitFormBoundary; charset="utf-8"'
    content_type, options = parse_options_header(valid_header)
    print("--- Parsing a valid header ---")
    print(f"Content-Type: {content_type}")
    print(f"Options: {options}")
    print("-" * 20)

    # 2. A malicious header that would cause ReDoS in the vulnerable version.
    # The payload consists of a quote followed by many characters that are not
    # a semicolon or a quote, which triggered exponential backtracking in the old regex.
    # The fixed regex handles this instantly because `"[^"]*"` fails quickly and
    # `[^;]*` matches without ambiguity.
    malicious_payload = '"' + 'a' * 50
    malicious_header = f'multipart/form-data; a={malicious_payload}'

    import time

    print("--- Parsing a malicious header with the fixed code ---")
    print(f"Header to parse: {malicious_header[:70]}...")
    start_time = time.time()
    content_type, options = parse_options_header(malicious_header)
    end_time = time.time()

    duration = end_time - start_time
    print(f"Parsing finished in {duration:.6f} seconds.")
    print(f"Content-Type: {content_type}")
    print(f"Options: {options}")
    print("\nWith the fix, parsing is nearly instantaneous and does not hang.")