dualfroz 4f58bd2e24 fix #7389: apiserver: accept unquoted multipart parameter values
In the Content-Disposition header of a multipart/form-data part, the
values of the name and filename parameters can be either a token or a
quoted-string, see RFC 7578, section 4.2, and RFC 6266. The upload
parser only matched the quoted form.

Browsers, curl and Python always quote these values, but the .NET
HttpClient, and with it PowerShell's Invoke-RestMethod -Form, uses the
token form for simple ASCII values, e.g.:

  Content-Disposition: form-data; name=filename; filename=foo.iso;
    filename*=utf-8''foo.iso

For such requests, neither the 'content' parameter nor the file part
got recognized and the upload failed.

Accept both forms. For the named parameters, make sure the unquoted
name is not just a prefix of a longer one, like 'checksum' for
'checksum-algorithm'.

Signed-off-by: Michal Fox <me@dualfroz.com>
2026-09-25 07:15:08 +02:00
S
Description
My contributions to proxmox-git/pve-http-server: 2 commits
96 KiB
0 Stars 1 Watchers 0 Forks
Languages
Perl 100%