mime: reduce allocs incurred by ParseMediatype

[austinderek]

This change is mostly gardening. It simplifies ParseMediatype and its
helper functions and reduces the amount of allocations they incur.

Here are some benchmark results:

goos: darwin
goarch: amd64
pkg: mime
cpu: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz
│ old │ new │
│ sec/op │ sec/op vs base │
ParseMediaType-8 55.26µ ± 1% 54.24µ ± 1% -1.84% (p=0.000 n=20)
ParseMediaTypeBogus-8 3.551µ ± 0% 3.428µ ± 0% -3.45% (p=0.000 n=20)
geomean 14.01µ 13.64µ -2.65%

                  │     old      │                 new                 │
                  │     B/op     │     B/op      vs base               │

ParseMediaType-8 38.48Ki ± 0% 37.38Ki ± 0% -2.85% (p=0.000 n=20)
ParseMediaTypeBogus-8 2.531Ki ± 0% 2.469Ki ± 0% -2.47% (p=0.000 n=20)
geomean 9.869Ki 9.606Ki -2.66%

                  │    old     │                new                 │
                  │ allocs/op  │ allocs/op   vs base                │

ParseMediaType-8 457.0 ± 0% 425.0 ± 0% -7.00% (p=0.000 n=20)
ParseMediaTypeBogus-8 25.00 ± 0% 21.00 ± 0% -16.00% (p=0.000 n=20)
geomean 106.9 94.47 -11.62%

---

🔄 This is a mirror of upstream PR golang#75565

[staging]

HackerOne Code Security Review

🟢 Scan Complete: 1 Issue(s)
🟠 Validation Complete: One or more Issues looked potentially actionable, so this was escalated to our network of engineers for manual review. Once this is complete you'll see an update posted.

Here's how the code changes were interpreted and info about the tools used for scanning.

📖 Summary of Changes

The changes in the mediatype.go file focus on improving error handling and string parsing techniques. The modifications include introducing predefined error variables, utilizing strings.CutPrefix for more efficient string manipulation, streamlining the decode2231Enc function, and adjusting the percentHexUnescape method to return a boolean. These updates aim to enhance code readability and potentially simplify error management. | File | Summary | | --- | --- | | src/mime/mediatype.go | The changes include refactoring error handling with predefined error variables, modifying string parsing methods to use strings.CutPrefix, simplifying the decode2231Enc function, and returning a boolean with percentHexUnescape instead of an error. |

ℹ️ Issues Detected

NOTE: These may not require action!

Below are unvalidated results from the Analysis Tools that ran during the latest scan for transparency. We investigate each of these for accuracy and relevance before surfacing them as a potential problem.

How will I know if something is a problem?
When validation completes, any concerns that warrant attention prior to merge will be posted as inline comments. These will show up in 2 ways:

• Expert review (most cases): Issues will be posted by experts who manually reviewed and validated them. These are real HackerOne engineers (not bots) reviewing through an integrated IDE-like tool. You can communicate with them like any other reviewer. They'll stay assigned and get notified with commit & comment updates.
• Automatically: In cases where our validation checks have highest confidence the problem is legitimate and urgent. These will include a description of contextual reasoning why & actionable next steps.

File & Line

Issue

src/mime/mediatype.go Line 345

The percentHexUnescape function has been modified to return a boolean instead of an error. This change removes detailed error information that was previously returned when malformed percent-encoded sequences were encountered. While the function still correctly identifies invalid sequences, it no longer provides specific information about what was wrong, which could make debugging more difficult. However, this is a low severity issue since the function still correctly rejects invalid input.

🧰 Analysis tools

- [ ✅ ] [HackerOne AI Code Analysis](https://www.pullrequest.com/blog/harnessing-ai-to-pinpoint-security-hotspots-in-code-review-a-deep-dive/) - [ ✅ ] [HackerOne AI Code Validation](https://www.hackerone.com/blog/ai-triage-code-validation-security) - [ ✅ ] [semgrep](https://semgrep.dev?&utm_source=hackerone&utm_campaign=pullrequest) - [ ✅ ] gosec - [ ✅ ] bandit

⏱️ Latest scan covered changes up to commit c44e2a2 (latest)