wwwattach: only pass the charset through if ASCII

[public-inbox.git] / lib / PublicInbox / WwwAttach.pm

diff --git a/lib/PublicInbox/WwwAttach.pm b/lib/PublicInbox/WwwAttach.pm
index d690ce411921b5fa40820b98923b53d23c1f001a..96103cb028e09b014e4bf29fb7e711c4e567ec08 100644 (file)
--- a/lib/PublicInbox/WwwAttach.pm
+++ b/lib/PublicInbox/WwwAttach.pm
@@ -27,7 +27,7 @@ sub get_attach ($$$) {
                if ($ct && (($ct->{discrete} || '') eq 'text')) {
                        # display all text as text/plain:
                        my $cset = $ct->{attributes}->{charset};
-                       if ($cset && ($cset =~ /\A[\w-]+\z/)) {
+                       if ($cset && ($cset =~ /\A[a-zA-Z0-9_\-]+\z/)) {
                                $res->[1]->[1] .= qq(; charset=$cset);
                        }
                } else { # TODO: allow user to configure safe types