Skip to content

Commit e9e11e1

Browse files
pgjonesdavidism
authored andcommitted
Lowercase the parsed options names
I cannot find a RFC that indicates that the option names are case sensitive whereas RFC6266 states that the `filename` option name is case insensitive. Therefore the best user experience is to lowercase the names. This will cause breaking changes if case sensitivity is relied upon, and hence users will need to use the lowercase name if so.
1 parent 446afc9 commit e9e11e1

File tree

3 files changed

+11
-2
lines changed

3 files changed

+11
-2
lines changed

CHANGES.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,9 @@ Version 2.2.0
99
- Fix compatibility with Python 3.11 by ensuring that ``end_lineno``
1010
and ``end_col_offset`` are present on AST nodes. :issue:`2425`
1111
- Add a new faster matching router based on a state
12-
machine. :pr:`2433`.
12+
machine. :pr:`2433`
13+
- Names within options headers are always converted to lowercase. This
14+
matches :rfc:`6266` that the case is not relevant. :issue:`2442`
1315

1416

1517
Version 2.1.2

src/werkzeug/http.py

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -390,6 +390,9 @@ def parse_options_header(
390390
391391
:param value: The header value to parse.
392392
393+
.. versionchanged:: 2.2
394+
Option names are always converted to lowercase.
395+
393396
.. versionchanged:: 2.1
394397
The ``multiple`` parameter is deprecated and will be removed in
395398
Werkzeug 2.2.
@@ -440,7 +443,7 @@ def parse_options_header(
440443
if not encoding:
441444
encoding = continued_encoding
442445
continued_encoding = encoding
443-
option = unquote_header_value(option)
446+
option = unquote_header_value(option).lower()
444447

445448
if option_value is not None:
446449
option_value = unquote_header_value(option_value, option == "filename")

tests/test_http.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -358,6 +358,10 @@ def test_parse_options_header_broken_values(self):
358358
assert http.parse_options_header(" , a ") == ("", {})
359359
assert http.parse_options_header(" ; a ") == ("", {})
360360

361+
def test_parse_options_header_case_insensitive(self):
362+
_, options = http.parse_options_header(r'something; fileName="File.ext"')
363+
assert options["filename"] == "File.ext"
364+
361365
def test_dump_options_header(self):
362366
assert http.dump_options_header("foo", {"bar": 42}) == "foo; bar=42"
363367
assert http.dump_options_header("foo", {"bar": 42, "fizz": None}) in (

0 commit comments

Comments
 (0)