ring-clojure/ring — pull request #148 by dlowe (2014-06-27 22:53:34+00:00)
Title: cope with newlines in parameter names

The code in parse-nested-keys is assuming that (.*?) will always match
the entire param-name, but that assumption fails without the (?s) modifier,
if param-name happens to include a newline character.

The eventual fallout from this bug is that :params will no longer be a map
after it runs through wrap-nested-params, which causes mayhem downstream with
all the code that assumes :params is a map.

It's possible that the fix actually belongs elsewhere -- for example, it
might be "more correct" to 400 these requests: I don't know what the
standards have to say about newlines in form parameters. Even if this
isn't the *whole* fix, though, IMO this change should be made on
"defense in depth" grounds.

FWIW: curl can produce requests with newline-containing form params,
like so:

```bash
$ cat > bad.form
foo
bar = baz
^D
$ curl --data-binary @bad.form ...
```