[php-src] Issue #8206: filenames in multipart/form-data are not percent decoded
| From: | cmb69 | Date: | Thu, 17 Mar 2022 15:10:34 +0000 |
| Subject: | [php-src] Issue #8206: filenames in multipart/form-data are not percent decoded | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-240396@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/8206
Comment Author: cmb69
Well, the [WHATWG living "standard" currently
claims](https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data):
> For field names and filenames for file fields, the result of the encoding in the previous
> bullet point must be escaped by replacing any 0x0A (LF) bytes with the byte sequence
>
%0A, 0x0D (CR) with %0D and 0x22
> (") with %22. The user agent must not perform any other
> escapes.
So these browsers appear to behave according to that standard (although that standardized behavior
makes no sense).