mime/multipart: FormDataContentType doesn't properly use quoted-string

[FMNSSun]

I've noticed this while digging into #26521 but afaict ParseMediaType behaves correctly according to RFC 2045 but the FormDataContentType doesn't return quoted-string. The function mentions that it formats according to Content-Type header but RFC 2616 Sect. 2.2 also excludes special characters
for use in token and must be part of a quoted-string as well.

What version of Go are you using (go version)?

go 1.10.3

Does this issue reproduce with the latest release?

Yes.

What did you do?

package main

import (
	"mime/multipart"
	"mime"
	"os"
	"fmt"
)

func main() {
	w := multipart.NewWriter(os.Stdout)
	err := w.SetBoundary("(boundary)")
	fmt.Println(err)
	ct := w.FormDataContentType()
	_, _, err = mime.ParseMediaType(ct)
	fmt.Println(ct, err)
}

(https://play.golang.org/p/5ZPC_EGHODn)

What did you expect to see?

multipart/form-data; boundary="(boundary)"

What did you see instead?

multipart/form-data; boundary=(boundary)

Which according to RFC 2045 and RFC 2616 is illegal as ( belongs to special characters that are only allowed in quoted-strings.

[agnivade]

/cc @bradfitz @minux

[FMNSSun]

Also, the boundary needs to be properly escaped when put into a quoted-string (\ is a valid boundary character as well).

[ianlancetaylor]

@FMNSSun As far as I can tell from RFC 2046, \ is not a valid boundary character.

boundary := 0*69<bchars> bcharsnospace

bcharsnospace := DIGIT / ALPHA / "'" / "(" / ")" /
                      "+" / "_" / "," / "-" / "." /
                      "/" / ":" / "=" / "?"

And indeed \ is not accepted by multipart.Writer.SetBoundary.

It doesn't seem that any additional quoting is needed for the boundary string.

[gopherbot]

Change https://golang.org/cl/154120 mentions this issue: mime/multipart: quote boundary in Content-Type if necessary