[php-src] Issue #8206: filenames in multipart/form-data are not percent decoded
| From: | TimWolla | Date: | Thu, 17 Mar 2022 12:58:52 +0000 |
| Subject: | [php-src] Issue #8206: filenames in multipart/form-data are not percent decoded | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-240389@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/8206
Comment Author: TimWolla
Chrome:
".txt:
%22.txt:
-------
For Firefox the behavior is identical.
-------
curl 7.68.0:
```
$ curl -F some_file=@"""\"""".txt 'localhost/test.php'
<pre>
string(5) "8.1.3"
array(1) {
["some_file"]=>
array(6) {
["name"]=>
string(5) "".txt"
["full_path"]=>
string(5) "".txt"
["type"]=>
string(10) "text/plain"
["tmp_name"]=>
string(14) "/tmp/phpTDrjGP"
["error"]=>
int(0)
["size"]=>
int(0)
}
}
</pre>
<form method="post" action="test.php"
enctype="multipart/form-data">
<input type="file" name="some_file">
<button type="submit">Submit</button>
</form>
```
```
$ curl -F some_file=@%22.txt 'localhost/test.php'
<pre>
string(5) "8.1.3"
array(1) {
["some_file"]=>
array(6) {
["name"]=>
string(7) "%22.txt"
["full_path"]=>
string(7) "%22.txt"
["type"]=>
string(10) "text/plain"
["tmp_name"]=>
string(14) "/tmp/phpOnB8wQ"
["error"]=>
int(0)
["size"]=>
int(0)
}
}
</pre>
<form method="post" action="test.php"
enctype="multipart/form-data">
<input type="file" name="some_file">
<button type="submit">Submit</button>
</form>
```
-----------------------
curl 7.82.0:
```
$ curl -F some_file=@"""\"""".txt 'localhost/test.php'
<pre>
string(5) "8.1.3"
array(1) {
["some_file"]=>
array(6) {
["name"]=>
string(7) "%22.txt"
["full_path"]=>
string(7) "%22.txt"
["type"]=>
string(10) "text/plain"
["tmp_name"]=>
string(14) "/tmp/phpCgZLmR"
["error"]=>
int(0)
["size"]=>
int(0)
}
}
</pre>
<form method="post" action="test.php"
enctype="multipart/form-data">
<input type="file" name="some_file">
<button type="submit">Submit</button>
</form>
```
```
curl -F some_file=@%22.txt 'localhost/test.php'
<pre>
string(5) "8.1.3"
array(1) {
["some_file"]=>
array(6) {
["name"]=>
string(7) "%22.txt"
["full_path"]=>
string(7) "%22.txt"
["type"]=>
string(10) "text/plain"
["tmp_name"]=>
string(14) "/tmp/php7hBe1L"
["error"]=>
int(0)
["size"]=>
int(0)
}
}
</pre>
<form method="post" action="test.php"
enctype="multipart/form-data">
<input type="file" name="some_file">
<button type="submit">Submit</button>
</form>
```