Parse Content-Type parameters with quoted-string awareness

Empty quoted boundary (`boundary=""`) left $matches[2] unset and
became a PHP warning. The substring match also picked `boundary=`
inside other parameter names and quoted values.

Split parameters only outside quoted-strings, reject an empty
boundary, and cover those cases in tests.

Author: iliaal

framework/CHANGELOG.md

@@ -4,6 +4,7 @@ Yii Framework 2 Change Log
 2.0.56 under development
 ------------------------
 
+- Bug #21073: Fix `MultipartFormDataParser` boundary extraction when `Content-Type` has additional parameters (iliaal)
 - Bug #21020: Fix duplicate `@return` annotation for `yii\db\ActiveRecord::hasOne()` (nazard)
 - Bug #20873: Fix PHPDoc annotations for the `yii\log\Target::$enabled` (mspirkov)
 - Enh #20875: Clarify the type of the `yii\base\Model::$errors` (mspirkov)

framework/web/MultipartFormDataParser.php

@@ -142,12 +142,8 @@ public function parse($rawBody, $contentType)
             return [];
         }
 
-        if (!preg_match('/boundary=(?:"([^"]*)"|([^;\s]*))/is', $contentType, $matches)) {
-            return [];
-        }
-
-        $boundary = isset($matches[1]) && $matches[1] !== '' ? $matches[1] : $matches[2];
-        if ($boundary === '') {
+        $boundary = $this->getMimeParameter($contentType, 'boundary');
+        if ($boundary === null || $boundary === '') {
             return [];
         }
 
@@ -214,6 +210,95 @@ public function parse($rawBody, $contentType)
         return $bodyParams;
     }
 
+    /**
+     * Returns a MIME header parameter (RFC 2045), or `null` if it is absent.
+     *
+     * `;` and `name=value` inside quoted-strings are not treated as delimiters.
+     *
+     * @param string $header Content-Type (or similar) header value
+     * @param string $name parameter name (matched case-insensitively)
+     * @return string|null
+     */
+    private function getMimeParameter($header, $name)
+    {
+        $name = strtolower($name);
+        $length = strlen($header);
+        $i = 0;
+
+        while ($i < $length) {
+            if ($header[$i] === '"') {
+                $i++;
+                while ($i < $length) {
+                    if ($header[$i] === '\\') {
+                        $i += ($i + 1 < $length) ? 2 : 1;
+                        continue;
+                    }
+                    if ($header[$i] === '"') {
+                        $i++;
+                        break;
+                    }
+                    $i++;
+                }
+                continue;
+            }
+
+            if ($header[$i] !== ';') {
+                $i++;
+                continue;
+            }
+
+            $i++;
+            while ($i < $length && ($header[$i] === ' ' || $header[$i] === "\t")) {
+                $i++;
+            }
+
+            $attrStart = $i;
+            while ($i < $length && $header[$i] !== '=' && $header[$i] !== ';') {
+                $i++;
+            }
+            $attr = strtolower(trim(substr($header, $attrStart, $i - $attrStart)));
+
+            if ($attr === '' || $i >= $length || $header[$i] !== '=') {
+                continue;
+            }
+
+            $i++;
+            while ($i < $length && ($header[$i] === ' ' || $header[$i] === "\t")) {
+                $i++;
+            }
+
+            if ($i < $length && $header[$i] === '"') {
+                $i++;
+                $value = '';
+                while ($i < $length) {
+                    if ($header[$i] === '\\' && $i + 1 < $length) {
+                        $value .= $header[$i + 1];
+                        $i += 2;
+                        continue;
+                    }
+                    if ($header[$i] === '"') {
+                        $i++;
+                        break;
+                    }
+                    $value .= $header[$i];
+                    $i++;
+                }
+            } else {
+                $valueStart = $i;
+                while ($i < $length && $header[$i] !== ';' && $header[$i] !== ' ' && $header[$i] !== "\t") {
+                    $i++;
+                }
+                $value = substr($header, $valueStart, $i - $valueStart);
+            }
+
+            if ($attr === $name) {
+                return $value;
+            }
+        }
+
+        return null;
+    }
+
     /**
      * Parses content part headers.
      * @param string $headerContent headers source content

tests/framework/web/MultipartFormDataParserTest.php

@@ -25,6 +25,10 @@ public function testParseWithBoundaryFollowedByAdditionalParameters(): void
             [
                 'multipart/form-data; boundary=' . $boundary . '; charset=utf-8',
                 'multipart/form-data; boundary="' . $boundary . '"; charset=utf-8',
+                'multipart/form-data; x-boundary=wrong; boundary=' . $boundary,
+                'multipart/form-data; foo="a; boundary=wrong"; boundary=' . $boundary,
+                'multipart/form-data; charset="boundary=abc"; boundary=' . $boundary,
+                'multipart/form-data; charset="boundary=abc"; boundary="' . $boundary . '"',
             ] as $contentType
         ) {
             $bodyParams = $parser->parse($rawBody, $contentType);
@@ -38,6 +42,8 @@ public function testParseWithoutBoundary(): void
 
         $this->assertSame([], $parser->parse("--irrelevant\r\n\r\ndata", 'multipart/form-data'));
         $this->assertSame([], $parser->parse('--irrelevant', 'multipart/form-data; boundary='));
+        $this->assertSame([], $parser->parse('--irrelevant', 'multipart/form-data; boundary=""'));
+        $this->assertSame([], $parser->parse('--irrelevant', 'multipart/form-data; boundary=""; charset=utf-8'));
     }
 
     public function testParse(): void