ktor-http/common/src/io/ktor/http/HeaderValueWithParameters.kt (1)

126-149: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

isQuoted() accepts values with an escaped closing quote.

Line 132 treats the last " as a valid closing delimiter without verifying it is not escaped, so malformed input like "abc\" can be reported as quoted.

💡 Suggested fix

 public fun String.isQuoted(): Boolean {
     if (length < 2) {
         return false
     }
     if (first() != '"' || last() != '"') {
         return false
     }
+    var trailingSlashes = 0
+    var trailingSlashIndex = lastIndex - 1
+    while (trailingSlashIndex >= 0 && this[trailingSlashIndex] == '\\') {
+        trailingSlashes++
+        trailingSlashIndex--
+    }
+    if (trailingSlashes % 2 != 0) {
+        return false
+    }
     var startIndex = 1
     do {
         val index = indexOf('"', startIndex)
         if (index == lastIndex) {
             break

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@ktor-http/common/src/io/ktor/http/HeaderValueWithParameters.kt` around lines
126 - 149, The isQuoted() routine incorrectly treats the final double-quote as a
valid closing delimiter without verifying it's not escaped; update the logic in
isQuoted() to check that the quote found at lastIndex is not escaped by counting
preceding backslashes (like you do for other quotes) and only accept it as a
closing quote when the number of preceding '\' characters is even (i.e. the
quote is not escaped); concretely, in the loop that finds index = indexOf('"',
startIndex) handle the case index == lastIndex by computing slashesCount the
same way you compute it for other quotes and return false if that quote is
escaped, otherwise accept and break/return true.