Fix ReDoS and consistency in multipart regexes

[CVE-2025-49007]

There is a ReDoS in multipart parsing here because it is not anchored to
the start of a line and so may match as part of its comments.

Previously in f92e056 Content-ID and
Content-Type were changed to only accept tab and space as whitespace
characters. Although that's what the various RFCs show as their BNF,
I that's supposed to be interpreted _after_ lines have been unfolded and
so we need to allow FWS "Foldable White Space".

CR is not allowed unescaped as part of quoted-string. It might be
technically valid with a leading backslash, but I don't believe that
case is worth supporting.

Co-authored-by: Matthew Draper <[email protected]>

Author: 2 people

lib/rack/multipart/parser.rb

@@ -31,10 +31,12 @@ class BoundaryTooLongError < StandardError
     Error = BoundaryTooLongError
 
     EOL = "\r\n"
+    FWS = /[ \t]+(?:\r\n[ \t]+)?/ # whitespace with optional folding
+    HEADER_VALUE = "(?:[^\r\n]|\r\n[ \t])*" # anything but a non-folding CRLF
     MULTIPART = %r|\Amultipart/.*boundary=\"?([^\";,]+)\"?|ni
-    MULTIPART_CONTENT_TYPE = /Content-Type:[ \t]*(.*)#{EOL}/ni
-    MULTIPART_CONTENT_DISPOSITION = /Content-Disposition:(.*)(?=#{EOL}(\S|\z))/ni
-    MULTIPART_CONTENT_ID = /Content-ID:[ \t]*([^#{EOL}]*)/ni
+    MULTIPART_CONTENT_TYPE = /^Content-Type:#{FWS}?(#{HEADER_VALUE})/ni
+    MULTIPART_CONTENT_DISPOSITION = /^Content-Disposition:#{FWS}?(#{HEADER_VALUE})/ni
+    MULTIPART_CONTENT_ID = /^Content-ID:#{FWS}?(#{HEADER_VALUE})/ni
 
     class Parser
       BUFSIZE = 1_048_576

test/spec_multipart.rb

@@ -976,7 +976,7 @@ def initialize(*)
     data = <<-EOF
 --AaB03x\r
 content-type: text/plain\r
-content-disposition: attachment; name="quoted\\\\chars\\"in\rname"\r
+content-disposition: attachment; name="quoted\\\\chars\\"in\tname"\r
 \r
 true\r
 --AaB03x--\r
@@ -989,7 +989,7 @@ def initialize(*)
     }
     env = Rack::MockRequest.env_for("/", options)
     params = Rack::Multipart.parse_multipart(env)
-    params["quoted\\chars\"in\rname"].must_equal 'true'
+    params["quoted\\chars\"in\tname"].must_equal 'true'
   end
 
   it "supports mixed case metadata" do