- Shipped
- September 2, 2026 at 11:43 PM UTC
- Author
- Kamo
- Commit
- 4de3a0e
Jakarta Mail hands back a MIME header exactly as it arrived, folds and all: RFC 5322 lets a mail header run over several lines by breaking it at a CRLF followed by whitespace, and getContentType() does not undo that. HTTP has no folding, so a CR or LF in a response header reads as a response-splitting attempt and Spring Security's FirewalledResponse throws rather than write it. Copying the part's Content-Type onto the response therefore did not produce an odd header, it produced a 500 with no body, which the browser draws as a broken image. Gmail folds a header once it runs past 78 characters, and a pasted macOS screenshot manages that on its own: the filename becomes a base64 encoded-word long enough to split the name= parameter across two lines. Every inline image and every attachment in such a message failed to load, in the member's own mailbox and in a shared one, while the bytes sat intact in the maildir. Unfold at the parser, so no folded value ever leaves it, and unfold again at the four serving endpoints, so a provider that forgets still cannot reach a header.