[php-src] Issue #8206: filenames in multipart/form-data are not percent decoded

From: Date: Wed, 16 Mar 2022 19:18:22 +0000
Subject: [php-src] Issue #8206: filenames in multipart/form-data are not percent decoded
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-240368@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/8206 Author: TimWolla ### Description For the following form: ```php <pre> <?php var_dump(PHP_VERSION); var_dump($_FILES); ?> </pre> <form method="post" action="test.php" enctype="multipart/form-data"> <input type="file" name="some_file"> <button type="submit">Submit</button> </form> ``` Uploading a file called ".txt in Firefox and Chrome Resulted in this output: ``` string(5) "8.1.3" array(1) { ["some_file"]=> array(6) { ["name"]=> string(7) "%22.txt" ["full_path"]=> string(7) "%22.txt" ["type"]=> string(10) "text/plain" ["tmp_name"]=> string(14) "/tmp/phpWl5h5S" ["error"]=> int(0) ["size"]=> int(0) } } ``` But I expected this output instead: ``` string(5) "8.1.3" array(1) { ["some_file"]=> array(6) { ["name"]=> string(5) "".txt" ["full_path"]=> string(5) "".txt" ["type"]=> string(10) "text/plain" ["tmp_name"]=> string(14) "/tmp/phpWl5h5S" ["error"]=> int(0) ["size"]=> int(0) } } ``` ----------------------------- Because I wasn't sure about the correct behavior myself I've checked with #curl on irc.libera.chat. In the replies I got the following references: - https://daniel.haxx.se/blog/2021/11/13/fun-multipart-form-data-inconsistencies/ - https://github.com/curl/curl/issues/7789 RFC 7578#2 specifies percent-encoding for use in HTTP So nowadays special characters, specifically the double quote (") are percent-encoded instead of backslash-encoded and PHP should properly decode those, like it already does for backslash encoding. ### PHP Version 8.1.3 ### Operating System Docker on Ubuntu 20.04

« previous php.bugs (#240368) next »