Skip to content
Navigation Menu
Sign in
Appearance settings
Platform
AI CODE CREATION
GitHub Copilot
Write better code with AI
GitHub Copilot app
Direct agents from issue to merge
MCP Registry
Integrate external tools
DEVELOPER WORKFLOWS
Actions
Automate any workflow
Codespaces
Instant dev environments
Issues
Plan and track work
Code Review
Manage code changes
Code Quality
Enforce quality at merge
APPLICATION SECURITY
GitHub Advanced Security
Find and fix vulnerabilities
Code security
Secure your code as you build
Secret protection
Stop leaks before they start
EXPLORE
Why GitHub
Documentation
Blog
Changelog
Marketplace
View all features
Solutions
BY COMPANY SIZE
Enterprises
Small and medium teams
Startups
Nonprofits
BY USE CASE
App Modernization
DevSecOps
DevOps
CI/CD
View all use cases
BY INDUSTRY
Healthcare
Financial services
Manufacturing
Government
View all industries
View all solutions
Resources
EXPLORE BY TOPIC
AI
Software Development
DevOps
Security
View all topics
EXPLORE BY TYPE
Customer stories
Events & webinars
Ebooks & reports
Business insights
GitHub Skills
SUPPORT & SERVICES
Documentation
Customer support
Community forum
Trust center
Partners
View all resources
Open Source
COMMUNITY
GitHub Sponsors
Fund open source developers
PROGRAMS
Security Lab
Maintainer Community
GitHub Stars
Archive Program
REPOSITORIES
Topics
Trending
Collections
Enterprise
ENTERPRISE SOLUTIONS
Enterprise platform
AI-powered developer platform
AVAILABLE ADD-ONS
GitHub Advanced Security
Enterprise-grade security features
Copilot for Business
Enterprise-grade AI features
Premium Support
Enterprise-grade 24/7 support
Pricing
Search
/
Sign in
Sign up
Appearance settings
You signed in with another tab or window.
Reload
to refresh your session.
You signed out in another tab or window.
Reload
to refresh your session.
You switched accounts on another tab or window.
Reload
to refresh your session.
Dismiss alert
{{ message }}
dotnet
/
runtime
Public
Notifications
You must be signed in to change notification settings
Fork
5.6k
Star
18.3k
Code
Issues
5k+
Pull requests
653
Discussions
Actions
Projects
Security and quality
70
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Security and quality
Insights
Validate ContentType.Name and ContentDisposition.FileName against header injection
- #128981
#128981
Draft
MihaZupan
with
Copilot
wants to merge 38 commits into
main
dotnet/runtime:main
from
copilot/better-contenttype-name-validation
dotnet/runtime:copilot/better-contenttype-name-validation
Copy head branch name to clipboard
Conversation
Commits
38
(38)
Checks
Files changed
Draft
Validate ContentType.Name and ContentDisposition.FileName against header injection
#128981
MihaZupan
with
Copilot
wants to merge 38 commits into
main
dotnet/runtime:main
from
copilot/better-contenttype-name-validation
dotnet/runtime:copilot/better-contenttype-name-validation
Copy head branch name to clipboard
Commits
Commits on Jun 4, 2026
Initial plan
Copilot
authored
afa0562
View commit details
Copy full SHA for afa0562
Browse repository at this point
Commits on Jun 18, 2026
Tighten DecodeEncoding to prevent header parameter injection
Show description for 5839a32
Copilot
and
mrek-msft
authored
5839a32
View commit details
Copy full SHA for 5839a32
Browse repository at this point
Commits on Aug 14, 2026
Use SearchValues for encoded-word token/data validation
Show description for ac45139
Copilot
and
rzikm
authored
ac45139
View commit details
Copy full SHA for ac45139
Browse repository at this point
Merge branch 'main' into copilot/better-contenttype-name-validation
mrek-msft
committed
0bb60b5
View commit details
Copy full SHA for 0bb60b5
Browse repository at this point
Commits on Aug 24, 2026
Minor fix
mrek-msft
committed
3505d03
View commit details
Copy full SHA for 3505d03
Browse repository at this point
Add tests exercising RFC 2047 spec.
mrek-msft
committed
b7ffb80
View commit details
Copy full SHA for b7ffb80
Browse repository at this point
Commits on Aug 25, 2026
some leftover test TODOs
mrek-msft
committed
51f414a
View commit details
Copy full SHA for 51f414a
Browse repository at this point
Commits on Aug 31, 2026
Merge MimeBasePart.DecodeHeaderValue and DecodeEncoding into a single method
Show description for 09759e8
Copilot
and
mrek-msft
authored
09759e8
View commit details
Copy full SHA for 09759e8
Browse repository at this point
Commits on Sep 2, 2026
Merge copilot changes to local.
mrek-msft
committed
5522557
View commit details
Copy full SHA for 5522557
Browse repository at this point
Modified handling ambigous encoding and improved readability of folding whitespace parsing.
mrek-msft
committed
44e4bda
View commit details
Copy full SHA for 44e4bda
Browse repository at this point
Improve test coverage and fix failing tests.
mrek-msft
committed
8ff78a5
View commit details
Copy full SHA for 8ff78a5
Browse repository at this point
Fix silent truncation of malformed Q-encoded escape sequences
Show description for 05a1d10
Copilot
and
mrek-msft
authored
05a1d10
View commit details
Copy full SHA for 05a1d10
Browse repository at this point
Commits on Sep 3, 2026
Revert changes in QEncodedStream
mrek-msft
committed
1763e49
View commit details
Copy full SHA for 1763e49
Browse repository at this point
Improve test data
mrek-msft
committed
8984cb8
View commit details
Copy full SHA for 8984cb8
Browse repository at this point
Improve test data
mrek-msft
committed
b02417c
View commit details
Copy full SHA for b02417c
Browse repository at this point
Allow multiple ecnoded words with different encodings.
mrek-msft
committed
66e2cb7
View commit details
Copy full SHA for 66e2cb7
Browse repository at this point
Return backward compatible behaviour and promote bad encoding exceptions
mrek-msft
committed
8e2fd28
View commit details
Copy full SHA for 8e2fd28
Browse repository at this point
Commits on Sep 4, 2026
Fixed wrong character in length test. Added support for checking encoded word max length in compliance with RFC 2047.
mrek-msft
committed
ee5dedf
View commit details
Copy full SHA for ee5dedf
Browse repository at this point
Fix length validation and tests.
mrek-msft
committed
a6d8757
View commit details
Copy full SHA for a6d8757
Browse repository at this point
Reject over-length encoded-words before charset resolution
Show description for e7e2396
Copilot
and
mrek-msft
authored
e7e2396
View commit details
Copy full SHA for e7e2396
Browse repository at this point
Remove useless long comment binding statements about order of checks.
mrek-msft
committed
b61e200
View commit details
Copy full SHA for b61e200
Browse repository at this point
Commits on Sep 7, 2026
Add test case
Show description for 6de02d0
mrek-msft
and
Copilot
authored
6de02d0
View commit details
Copy full SHA for 6de02d0
Browse repository at this point
Add test case
Show description for 16995ef
mrek-msft
and
Copilot
authored
16995ef
View commit details
Copy full SHA for 16995ef
Browse repository at this point
Catch unsupported encoding exceptions same as format.
Show description for f69c6cf
mrek-msft
and
Copilot
authored
f69c6cf
View commit details
Copy full SHA for f69c6cf
Browse repository at this point
Handle unsupported charset in ContentType
Show description for cc1f419
mrek-msft
and
Copilot
authored
cc1f419
View commit details
Copy full SHA for cc1f419
Browse repository at this point
Remove unused using directive for InteropServices
Show description for 4880dae
mrek-msft
and
Copilot
authored
4880dae
View commit details
Copy full SHA for 4880dae
Browse repository at this point
Fix typo in comment
Show description for 7b77d0d
mrek-msft
and
Copilot
authored
7b77d0d
View commit details
Copy full SHA for 7b77d0d
Browse repository at this point
Add test case
mrek-msft
committed
15df36c
View commit details
Copy full SHA for 15df36c
Browse repository at this point
Remove wrapping encoded word in quoted string (RFC 2047 prohibits this)
mrek-msft
committed
8febeb2
View commit details
Copy full SHA for 8febeb2
Browse repository at this point
Fix assert expect/actual param order.
mrek-msft
committed
007fa8c
View commit details
Copy full SHA for 007fa8c
Browse repository at this point
Improving RFC2047 compliance
Show description for f3b391b
mrek-msft
and
Copilot
authored
f3b391b
View commit details
Copy full SHA for f3b391b
Browse repository at this point
Merge branch 'copilot/better-contenttype-name-validation' of https://github.com/dotnet/runtime into copilot/better-contenttype-name-validation
mrek-msft
committed
9776cb0
View commit details
Copy full SHA for 9776cb0
Browse repository at this point
Commits on Sep 8, 2026
Wrap mime fields in quotes again despite its against RFC.
mrek-msft
committed
f79bdfc
View commit details
Copy full SHA for f79bdfc
Browse repository at this point
Add test case
Show description for 5bf01f2
mrek-msft
and
Copilot
authored
5bf01f2
View commit details
Copy full SHA for 5bf01f2
Browse repository at this point
Fix handling " in encoded word for MIME headers
mrek-msft
committed
4ccac87
View commit details
Copy full SHA for 4ccac87
Browse repository at this point
Merge branch 'copilot/better-contenttype-name-validation' of https://github.com/dotnet/runtime into copilot/better-contenttype-name-validation
mrek-msft
committed
596fe00
View commit details
Copy full SHA for 596fe00
Browse repository at this point
Commits on Sep 9, 2026
Fix logical operator
Show description for 132dc9f
mrek-msft
and
Copilot
authored
132dc9f
View commit details
Copy full SHA for 132dc9f
Browse repository at this point
Enhance comments
Show description for 1c7cd96
mrek-msft
and
Copilot
authored
1c7cd96
View commit details
Copy full SHA for 1c7cd96
Browse repository at this point
You can’t perform that action at this time.
