Item12991: Trying to attach a file with a filename that contains quotes (") results in spurious error

pencil
Priority: Normal
Current State: Confirmed
Released In: n/a
Target Release: n/a
Applies To: Engine
Component: FoswikiEngine
Branches:
Reported By: DavidTonhofer
Waiting For:
Last Change By: CrawfordCurrie
I am trying to attach a file named

Settings for the "FRITZ!Box Fon WLAN 7390".pdf

This is a legal filename on ext4.

Fowswiki says (I added the single quotes for clarity):

Attention

Either you did not specify a file name, or the file you are trying to upload 'Settings for the \' has no content. You may not upload an empty file.

Please go back in your browser and check again. 

Evidently escaping goes haywire.

-- DavidTonhofer - 17 Aug 2014

This error appears to be deep in CGI I suspect. Dumping the initial CGI object, the backslash has been doubled, so it's no longer acting as an escape.

Here is a dump of the CGI object right after it's created:

                   '.tmpfiles' => {
                                    '*Fh::fh00001\\' => {
                                                          'info' => {
                                                                      'Content-Type' => 'application/pdf',
                                                                      'Content-Disposition' => 'form-data; name="filepath"; filename="\\"FRITZ!Box Fon WLAN 7390\\".pdf"'
                                                                    },
                                                          'hndl' => ${$VAR1}->{'param'}->{'filepath'}->[0],
                                                          'name' => bless( do{\(my $o = '/usr/tmp/CGItemp17929')}, 'CGITempFile' )
                                                        }
                                  },
  

Dumped in Engine/CGI.pm in prepareBodyParameters.

Wireshark trace shows a single backslash escaped ", so the doubling of the escaping backslash causes the issue. Not sure where that gets doubled.

Tried to see if I could recreate with Chromium, and the browser treats the " " as delimiters, stripping them and the trailing .pdf, so I can't even test with chromium.

-- GeorgeClark - 02 Dec 2014
 

ItemTemplate edit

Summary Trying to attach a file with a filename that contains quotes (") results in spurious error
ReportedBy DavidTonhofer
Codebase 1.1.9
SVN Range
AppliesTo Engine
Component FoswikiEngine
Priority Normal
CurrentState Confirmed
WaitingFor
Checkins
TargetRelease n/a
ReleasedIn n/a
CheckinsOnBranches
trunkCheckins
masterCheckins
ItemBranchCheckins
Release01x01Checkins
Topic revision: r4 - 21 Mar 2017, CrawfordCurrie
The copyright of the content on this website is held by the contributing authors, except where stated elsewhere. See Copyright Statement. Creative Commons License    Legal Imprint    Privacy Policy