It would help if you could point to packages that generate this invalid information, and if you could point to how other MIME parsing code, in other languages, handles this case. That is, we want to accept data that is out there in the wild, but we want to avoid being unnecessarily loose. Thanks.

@ianlancetaylor I have found the following examples on Python, Java and C#. All of them returns charset as "UTF-8" correctly, none throws an error.

Example in Python 3:

>>> import cgi
>>> mimetype, options = cgi.parse_header("text/plain; charset=UTF-8; charset=UTF-8; format=flowed")
>>> print(mimetype)
text/plain
>>> print(options)
{'charset': 'UTF-8', 'format': 'flowed'}

Example in Java:

import org.apache.http.entity.ContentType;
import java.nio.charset.Charset;

class TestContentTypeParsing {
        public static void main (String args []) {
                ContentType contentType = ContentType.parse("text/plain; charset=UTF-8; charset=UTF-8; format=flowed");
                Charset charset = contentType.getCharset();
                System.out.println (charset);
    }
}

prints "UTF-8"

Example in C#:

using System;
using System.Net.Mime;

public class TestContentTypeParsing
{
    static public void Main ()
    {
        var contentType = new ContentType("text/plain; charset=UTF-8; charset=UTF-8; format=flowed");
        Console.WriteLine("{0} ({1})", contentType.MediaType, contentType.CharSet);
    }
}

prints "text/plain (UTF-8)"

The example in Go:

package main

import (
	"fmt"
	"mime"
)

func main() {
	mediaType, params, err := mime.ParseMediaType("text/plain; charset=UTF-8; charset=UTF-8; format=flowed")
	fmt.Printf("mediaType = '%s', params = %+v, err = %v\n", mediaType, params, err)
}

prints "mediaType = '', params = map[], err = mime: duplicate parameter name"
https://play.golang.org/p/kEMGv60ElWz

Thanks, that wasn't quite what I was asking. Can you describe which programs generate the duplicate information? I'm trying to understand why we should make this change. If no program generates duplicates, then it seems to me that stricter is better, as it avoids any confusion about which parameter applies.

@neganovalexey you wrote "It is possible to receive an email ...". The important question is "is it likely?" Do you have instances of this happening in real use cases? If not, then we are unlikely to add what might end up being some kind of security hole (by picking one or the other differently from other software) for purely speculative motivations.

Timed out in state WaitingForInfo. Closing.

(I am just a bot, though. Please speak up if this is a mistake or you have the requested information.)

I actually have such an email in my Inbox. The header field is this:

Content-Type: text/html; charset=utf-8; charset=UTF-8