Patched code sample

import re
from email.message import Message


def vulnerable_parse_options_header(header: str) -> tuple[str, dict[str, str]]:
    """Represents the old, vulnerable parsing using email.message.Message."""
    msg = Message()
    msg["content-type"] = header
    # .get_params() transparently decodes RFC 2231 and overwrites the simple key.
    _, params = msg.get_params(header="content-type")
    return _, dict(params)


def fixed_parse_options_header(header: bytes) -> tuple[bytes, dict[bytes, bytes]]:
    """
    Represents the fixed parser, which manually processes parameters
    without RFC 2231 decoding, thus avoiding the vulnerability.
    """
    _header_break_re = re.compile(rb"[;]\s*")
    parts = _header_break_re.split(header)
    content_type = parts[0].strip()
    params: dict[bytes, bytes] = {}
    for param in parts[1:]:
        if b"=" not in param:
            continue
        key, value = param.split(b"=", 1)
        key = key.strip().lower()
        value = value.strip()
        if len(value) >= 2 and value.startswith(b'"') and value.endswith(b'"'):
            value = value[1:-1]
        params[key] = value
    return content_type, params


# Header that exploits the difference between parsers.
# A WAF/proxy sees `filename="safe.txt"`.
# The vulnerable backend sees `filename="malicious.exe"`.
malicious_header_str = "form-data; name=\"file\"; filename=\"safe.txt\"; filename*=utf-8''malicious.exe"
malicious_header_bytes = malicious_header_str.encode("ascii")

# --- Demonstration ---

# 1. Vulnerable behavior
_ct_vuln, params_vuln = vulnerable_parse_options_header(malicious_header_str)
print(f"Vulnerable parser sees filename: {params_vuln.get('filename')}")

# 2. Fixed behavior
_ct_fixed, params_fixed = fixed_parse_options_header(malicious_header_bytes)
print(f"Fixed parser sees filename: {params_fixed.get(b'filename').decode()}")