[php-src] Issue #8206: filenames in multipart/form-data are not percent decoded
| From: | TimWolla | Date: | Wed, 16 Mar 2022 19:18:22 +0000 |
| Subject: | [php-src] Issue #8206: filenames in multipart/form-data are not percent decoded | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-240368@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/8206
Author: TimWolla
### Description
For the following form:
```php
<pre>
<?php
var_dump(PHP_VERSION);
var_dump($_FILES);
?>
</pre>
<form method="post" action="test.php"
enctype="multipart/form-data">
<input type="file" name="some_file">
<button type="submit">Submit</button>
</form>
```
Uploading a file called
".txt in Firefox and Chrome
Resulted in this output:
```
string(5) "8.1.3"
array(1) {
["some_file"]=>
array(6) {
["name"]=>
string(7) "%22.txt"
["full_path"]=>
string(7) "%22.txt"
["type"]=>
string(10) "text/plain"
["tmp_name"]=>
string(14) "/tmp/phpWl5h5S"
["error"]=>
int(0)
["size"]=>
int(0)
}
}
```
But I expected this output instead:
```
string(5) "8.1.3"
array(1) {
["some_file"]=>
array(6) {
["name"]=>
string(5) "".txt"
["full_path"]=>
string(5) "".txt"
["type"]=>
string(10) "text/plain"
["tmp_name"]=>
string(14) "/tmp/phpWl5h5S"
["error"]=>
int(0)
["size"]=>
int(0)
}
}
```
-----------------------------
Because I wasn't sure about the correct behavior myself I've checked with #curl on
irc.libera.chat. In the replies I got the following references:
- https://daniel.haxx.se/blog/2021/11/13/fun-multipart-form-data-inconsistencies/
- https://github.com/curl/curl/issues/7789
RFC 7578#2 specifies percent-encoding for use in HTTP
So nowadays special characters, specifically the double quote (") are
percent-encoded instead of backslash-encoded and PHP should properly decode those, like it already
does for backslash encoding.
### PHP Version
8.1.3
### Operating System
Docker on Ubuntu 20.04