Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings
This repository was archived by the owner on Sep 24, 2018. It is now read-only.
This repository was archived by the owner on Sep 24, 2018. It is now read-only.

Does not parse Content-Disposition properly #1744

Copy link
Copy link

Description

@Mange
Issue body actions

I'm trying to POST a new media but get back the following error:

Invalid Content-Disposition supplied. Content-Disposition needs to be formatted as "filename=image.png" or similar.

I can work around that by using an invalid Content-Disposition of literally filename=unquoted_name.jpg, but that's not how the header is supposed to look like.

From RFC2616, section 19.5.1:

   content-disposition = "Content-Disposition" ":"
                         disposition-type *( ";" disposition-parm )
   disposition-type = "attachment" | disp-extension-token
   disposition-parm = filename-parm | disp-extension-parm
   filename-parm = "filename" "=" quoted-string
   disp-extension-token = token
   disp-extension-parm = token "=" ( token | quoted-string )

An example is

   Content-Disposition: attachment; filename="fname.ext"
Header Result Expected
attachment; filename="foo.jpg" ❌ Error foo.jpg
attachment;filename="foo.jpg" ❌ Error foo.jpg
inline; filename=bar.pdf ❌ Error bar.pdf
inline; extension=whatever; filename=baz.png; other=value ❌ Error baz.png
filename="baz.png" Filenames with " in them(?) baz.png or error
filename=baz.png baz.png baz.png or error

Since RFC2616 describes headers in responses from a server, one could argue that this header isn't the same one and has other parsing rules, but I would then suggest that we use a dedicated X-Filename header instead of shadowing another well-known header.

Reactions are currently unavailable

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

Morty Proxy This is a proxified and sanitized view of the page, visit original site.