# HG changeset patch
# User Thibault Nélis <tn@osimis.io>
# Date 1484568431 -3600
# Node ID 69b0f4e8a49b3df9474120c0534770e459a23403
# Parent  521adccdbfa05bf1e97ffa0a1c93d7194c9e1ee2
Escape multipart type parameter value in Content-Type header

## Summary

Multipart responses do not quote/escape the value of their type
parameter (the subtype) even though it always contains at least one
special character (the slash "/"), which confuses standard-compliant
HTTP clients.

## Details

The Content-Type header in HTTP is in RFC 7231, Section 3.1.1.5:

  https://tools.ietf.org/html/rfc7231#section-3.1.1.5

The section defers to the media type section (3.1.1.1) for the syntax of
the media type:

  https://tools.ietf.org/html/rfc7231#section-3.1.1.1

This states that a parameter value can be quoted:

  parameter      = token "=" ( token / quoted-string )

  A parameter value that matches the token production can be transmitted
  either as a token or within a quoted-string.  The quoted and unquoted
  values are equivalent.

Tokens are defined in RFC 7230, Section 3.2.6 (via RFC 7231, appendix
C):

  https://tools.ietf.org/html/rfc7231#appendix-C
  https://tools.ietf.org/html/rfc7230#section-3.2.6

Here we observe that tokens cannot contain a slash "/" character:

  token          = 1*tchar

  tchar          = "!" / "#" / "$" / "%" / "&" / "'" / "*"
                 / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~"
                 / DIGIT / ALPHA
                 ; any VCHAR, except delimiters

  Delimiters are chosen from the set of US-ASCII visual characters not
  allowed in a token (DQUOTE and "(),/:;<=>?@[\]{}").

However, the current implementation does not quote/escape the value of
the type parameter:

  multipart/related; type=application/dicom

Instead, it should be:

  multipart/related; type="application/dicom"

All of this also seems to apply to the MIME Content-Type header
definition, even though it is a little different:

  https://www.iana.org/assignments/message-headers
  https://tools.ietf.org/html/rfc2045#section-5.1
  https://tools.ietf.org/html/rfc2387

diff -r 521adccdbfa0 -r 69b0f4e8a49b Core/HttpServer/HttpOutput.cpp
--- a/Core/HttpServer/HttpOutput.cpp	Mon Jan 09 17:13:01 2017 +0100
+++ b/Core/HttpServer/HttpOutput.cpp	Mon Jan 16 13:07:11 2017 +0100
@@ -442,7 +442,7 @@
 
     multipartBoundary_ = SystemToolbox::GenerateUuid();
     multipartContentType_ = contentType;
-    header += "Content-Type: multipart/" + subType + "; type=" + contentType + "; boundary=" + multipartBoundary_ + "\r\n\r\n";
+    header += "Content-Type: multipart/" + subType + "; type=\"" + contentType + "\"; boundary=" + multipartBoundary_ + "\r\n\r\n";
 
     stream_.Send(true, header.c_str(), header.size());
     state_ = State_WritingMultipart;