Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Filename normalisation of form-data/multipart file uploads (umlauts on Apple clients) #2625

Merged
merged 2 commits into from Dec 13, 2022
Merged

Filename normalisation of form-data/multipart file uploads (umlauts on Apple clients) #2625

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
91189dd
Normalize filenames of form uploads to NFC to avoid problems with Mac…
Tronic Dec 13, 2022
0046d2e
Split overlong lines (linter)
Tronic Dec 13, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 11 additions & 0 deletions sanic/request.py
View file
Open in desktop
Expand Up @@ -27,6 +27,7 @@
from sanic.app import Sanic

import email.utils
import unicodedata
import uuid

from collections import defaultdict
Expand Down Expand Up @@ -1084,6 +1085,16 @@ def parse_multipart_form(body, boundary):
form_parameters["filename*"]
)
file_name = unquote(value, encoding=encoding)

# Normalize to NFC (Apple MacOS/iOS send NFD)
# Notes:
# - No effect for Windows, Linux or Android clients which
# already send NFC
# - Python open() is tricky (creates files in NFC no matter
# which form you use)
if file_name is not None:
file_name = unicodedata.normalize("NFC", file_name)

elif form_header_field == "content-type":
content_type = form_header_value
content_charset = form_parameters.get("charset", "utf-8")
Expand Down
18 changes: 18 additions & 0 deletions tests/test_requests.py
View file
Open in desktop
Expand Up @@ -1293,6 +1293,24 @@ async def get(request):
"------sanic--\r\n",
"filename_\u00A0_test",
),
# Umlaut using NFC normalization (Windows, Linux, Android)
(
"------sanic\r\n"
'content-disposition: form-data; filename*="utf-8\'\'filename_%C3%A4_test"; name="test"\r\n'
"\r\n"
"OK\r\n"
"------sanic--\r\n",
"filename_\u00E4_test",
),
# Umlaut using NFD normalization (MacOS client)
(
"------sanic\r\n"
'content-disposition: form-data; filename*="utf-8\'\'filename_a%CC%88_test"; name="test"\r\n'
"\r\n"
"OK\r\n"
"------sanic--\r\n",
"filename_\u00E4_test", # Sanic should normalize to NFC
),
],
)
def test_request_multipart_files(app, payload, filename):
Expand Down