From 4d6e88dc988e43d90c1e2f52e6694a51f9f8152d Mon Sep 17 00:00:00 2001
From: Sam Brannen <104798+sbrannen@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:40:53 +0200
Subject: [PATCH] Fix off-by-one error in MimeTypeUtils.parseMimeType()

Due to changes made in commit 41cd6879bd, MimeTypeUtils now raises a
StringIndexOutOfBoundsException instead of an InvalidMimeTypeException
when parsing certain invalid mime types -- for example, for a value
wrapped in double quotes which does not contain a ";" character.

To address that minor regression, this commit replaces
`mimeType.charAt(nextIndex - 1) != '\\'` with
`(nextIndex == 0 || mimeType.charAt(nextIndex - 1) != '\\')` to avoid
invoking `String#charAt` with a negative value.

See gh-36730
Closes gh-36971
---
 .../java/org/springframework/util/MimeTypeUtils.java     | 4 ++--
 .../java/org/springframework/util/MimeTypeTests.java     | 9 ++++++++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/spring-core/src/main/java/org/springframework/util/MimeTypeUtils.java b/spring-core/src/main/java/org/springframework/util/MimeTypeUtils.java
index 24add7f4f3d..9fd30d0593a 100644
--- a/spring-core/src/main/java/org/springframework/util/MimeTypeUtils.java
+++ b/spring-core/src/main/java/org/springframework/util/MimeTypeUtils.java
@@ -187,7 +187,7 @@ public abstract class MimeTypeUtils {
 
 	/**
 	 * Parse the given String into a single {@code MimeType}.
-	 * Recently parsed {@code MimeType} are cached for further retrieval.
+	 * <p>Recently parsed {@code MimeType} values are cached for future retrieval.
 	 * @param mimeType the string to parse
 	 * @return the mime type
 	 * @throws InvalidMimeTypeException if the string cannot be parsed
@@ -238,7 +238,7 @@ public abstract class MimeTypeUtils {
 						break;
 					}
 				}
-				else if (ch == '"' && mimeType.charAt(nextIndex - 1) != '\\') {
+				else if (ch == '"' && (nextIndex == 0 || mimeType.charAt(nextIndex - 1) != '\\')) {
 					quoted = !quoted;
 				}
 				nextIndex++;
diff --git a/spring-core/src/test/java/org/springframework/util/MimeTypeTests.java b/spring-core/src/test/java/org/springframework/util/MimeTypeTests.java
index 6346b8ec540..178716802d4 100644
--- a/spring-core/src/test/java/org/springframework/util/MimeTypeTests.java
+++ b/spring-core/src/test/java/org/springframework/util/MimeTypeTests.java
@@ -107,7 +107,7 @@ class MimeTypeTests {
 		assertThat(mimeType.getParameter("type")).isEqualTo("\"application/soap+xml;action=\\\"https://x.y.z\\\"\"");
 	}
 
-	@Test
+	@Test  //  gh-36730
 	void parseParameterWithQuotedPair() {
 		String s = "text/plain;twelve=\"1\\\"2\"";
 		MimeType mimeType = MimeType.valueOf(s);
@@ -295,6 +295,13 @@ class MimeTypeTests {
 				MimeTypeUtils.parseMimeType("audio/*;attr=\""));
 	}
 
+	@Test  // gh-36971
+	void parseMimeTypeWrappedInQuotes() {
+		assertThatExceptionOfType(InvalidMimeTypeException.class)
+				.isThrownBy(() -> MimeTypeUtils.parseMimeType("\"application/xml\""))
+				.withMessageContaining("Invalid token character '\"'");
+	}
+
 	@Test
 	void parseMimeTypeNull() {
 		assertThatExceptionOfType(InvalidMimeTypeException.class).isThrownBy(() ->