Refs #36520 -- Only passed header value for parsing on multi-part forms

RealOrangeOne · RealOrangeOne · commit 72c66a1b6593 · 2025-08-28T12:12:20.000+01:00
Parsing should only be done on the value. The implementation happens to work, but shouldn't depend on that working.
diff --git a/django/http/multipartparser.py b/django/http/multipartparser.py
@@ -721,11 +721,10 @@ def parse_boundary_stream(stream, max_header_size):
 
     # Eliminate blank lines
     for line in header.split(b"\r\n"):
-        # This terminology ("main value" and "dictionary of
-        # parameters") is from the Python docs.
         try:
-            main_value_pair, params = parse_header_parameters(line.decode())
-            name, value = main_value_pair.split(":", 1)
+            name, value_with_params = line.decode().split(":", 1)
+            name = name.lower().rstrip(" ")
+            value, params = parse_header_parameters(value_with_params.lstrip(" "))
             params = {k: v.encode() for k, v in params.items()}
         except ValueError:  # Invalid header.
             continue
diff --git a/tests/requests_tests/tests.py b/tests/requests_tests/tests.py
@@ -450,6 +450,34 @@ def test_body_after_POST_multipart_form_data(self):
         with self.assertRaises(RawPostDataException):
             request.body
 
+    def test_malformed_multipart_header(self):
+        for header in [
+            'Content-Disposition : form-data; name="name"',
+            'Content-Disposition:form-data; name="name"',
+            'Content-Disposition :form-data; name="name"',
+        ]:
+            with self.subTest(header):
+                payload = FakePayload(
+                    "\r\n".join(
+                        [
+                            "--boundary",
+                            header,
+                            "",
+                            "value",
+                            "--boundary--",
+                        ]
+                    )
+                )
+                request = WSGIRequest(
+                    {
+                        "REQUEST_METHOD": "POST",
+                        "CONTENT_TYPE": "multipart/form-data; boundary=boundary",
+                        "CONTENT_LENGTH": len(payload),
+                        "wsgi.input": payload,
+                    }
+                )
+                self.assertEqual(request.POST, {"name": ["value"]})
+
     def test_body_after_POST_multipart_related(self):
         """
         Reading body after parsing multipart that isn't form-data is allowed
