fixed a few more multipart form handling bugs

mojolicious · Oct 26, 2013 · d83c784 · d83c784
1 parent 49a4ffc
commit d83c784
Show file tree

Hide file tree

Showing 3 changed files with 62 additions and 3 deletions.
diff --git a/Changes b/Changes
@@ -1,6 +1,6 @@
 
 4.51  2013-10-26
-  - Fixed case sensitivity bug in multipart form handling.
+  - Fixed a few multipart form handling bugs.
 
 4.50  2013-10-22
   - Deprecated Mojo::UserAgent::app in favor of

diff --git a/lib/Mojo/Message.pm b/lib/Mojo/Message.pm
@@ -277,9 +277,9 @@ sub _parse_formdata {
     }
 
     next unless my $disposition = $part->headers->content_disposition;
-    my ($filename) = $disposition =~ /[; ]filename\s*=\s*"?([^"]*)"?/i;
+    my ($filename) = $disposition =~ /[; ]filename\s*=\s*"?((?:\\"|[^"])*)"?/i;
     next if ($upload && !defined $filename) || (!$upload && defined $filename);
-    my ($name) = $disposition =~ /[; ]name\s*=\s*"?([^";]+)"?/i;
+    my ($name) = $disposition =~ /[; ]name\s*=\s*"?((?:\\"|[^";])+)"?/i;
     if ($charset) {
       $name     = decode($charset, $name)     // $name     if $name;
       $filename = decode($charset, $filename) // $filename if $filename;

diff --git a/t/mojo/request.t b/t/mojo/request.t
@@ -1639,6 +1639,65 @@ is $req->param('Zuname'),  '',  'right value';
 is $req->param('Text'),    '',  'right value';
 is $req->content->parts->[0]->asset->slurp, 'T', 'right content';
 
+# Chrome 30 multipart/form-data request (with quotation marks)
+$req = Mojo::Message::Request->new;
+$req->parse("POST / HTTP/1.1\x0d\x0a");
+$req->parse("Host: 127.0.0.1:3000\x0d\x0a");
+$req->parse("Connection: keep-alive\x0d\x0a");
+$req->parse("Content-Length: 178\x0d\x0a");
+$req->parse('Accept: text/html,application/xhtml+xml,application/xml;q=');
+$req->parse("0.9,image/webp,*/*;q=0.8\x0d\x0a");
+$req->parse("Origin: http://127.0.0.1:3000\x0d\x0a");
+$req->parse('User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_0) App');
+$req->parse('leWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari');
+$req->parse("/537.36\x0d\x0a");
+$req->parse('Content-Type: multipart/form-data; boundary=----WebKitFormBoun');
+$req->parse("daryMTelhBLWA9N3KXAR\x0d\x0a");
+$req->parse("Referer: http://127.0.0.1:3000/\x0d\x0a");
+$req->parse("Accept-Encoding: gzip,deflate,sdch\x0d\x0a");
+$req->parse("Accept-Language: en-US,en;q=0.8\x0d\x0a\x0d\x0a");
+$req->parse("------WebKitFormBoundaryMTelhBLWA9N3KXAR\x0d\x0a");
+$req->parse('Content-Disposition: form-data; na');
+$req->parse('me="foo %22bar%22 baz"; filename="fo%22o%22.txt"');
+$req->parse("\x0d\x0a\x0d\x0atest\x0d\x0a");
+$req->parse("------WebKitFormBoundaryMTelhBLWA9N3KXAR--\x0d\x0a");
+ok $req->is_finished, 'request is finished';
+is $req->method,      'POST', 'right method';
+is $req->version,     '1.1', 'right version';
+is $req->url,         '/', 'right URL';
+is $req->upload('foo %22bar%22 baz')->filename, 'fo%22o%22.txt',
+  'right filename';
+is $req->upload('foo %22bar%22 baz')->slurp, 'test', 'right value';
+
+# Firefox 24 multipart/form-data request (with quotation marks)
+$req = Mojo::Message::Request->new;
+$req->parse("POST / HTTP/1.1\x0d\x0a");
+$req->parse("Host: 127.0.0.1:3000\x0d\x0a");
+$req->parse('User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.');
+$req->parse("0) Gecko/20100101 Firefox/24.0\x0d\x0a");
+$req->parse('Accept: text/html,application/xhtml+xml,application/xml;q=0.9');
+$req->parse(",*/*;q=0.8\x0d\x0a");
+$req->parse("Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3\x0d\x0a");
+$req->parse("Accept-Encoding: gzip, deflate\x0d\x0a");
+$req->parse("Referer: http://127.0.0.1:3000/\x0d\x0a");
+$req->parse("Connection: keep-alive\x0d\x0a");
+$req->parse('Content-Type: multipart/form-data; boundary=-----------------');
+$req->parse("----------20773201241877674789807986058\x0d\x0a");
+$req->parse("Content-Length: 210\x0d\x0a\x0d\x0a");
+$req->parse('-----------------------------2077320124187767478980');
+$req->parse("7986058\x0d\x0aContent-Disposition: form-data; na");
+$req->parse('me="foo \\"bar\\" baz"; filename="fo\\"o\\".txt"');
+$req->parse("\x0d\x0a\x0d\x0atest\x0d\x0a");
+$req->parse('-----------------------------2077320124187767');
+$req->parse("4789807986058--\x0d\x0a");
+ok $req->is_finished, 'request is finished';
+is $req->method,      'POST', 'right method';
+is $req->version,     '1.1', 'right version';
+is $req->url,         '/', 'right URL';
+is $req->upload('foo \"bar\" baz')->filename, 'fo\\"o\\".txt',
+  'right filename';
+is $req->upload('foo \"bar\" baz')->slurp, 'test', 'right value';
+
 # Chrome 5 multipart/form-data request (UTF-8)
 $req = Mojo::Message::Request->new;
 my ($fname, $sname, $sex, $avatar, $submit)