OpenAPITools / OpenAPITools/openapi-generator
[python] multipart/form-data headers get URL-encoded via aiohttp.FormData
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 26.8k
- Forks
- 7.7k
- PR merge metrics
- PR metrics pending
Description
I have not specified [BUG] here because maybe this is still arguable, but I think something is wrong or at least missing.
This concerns how content disposition headers such as 'filename' on multipart/form-data payloads are handled inside the python asyncio client. These headers currently always get URL-encoded, which I think is not desirable or at least should be configurable. As far as I understand it, the specification does not require URL encoding for this content type (see for example https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST and https://datatracker.ietf.org/doc/html/rfc7578#section-4.2), and users of the generated client might therefore pass in, for example, file names containing spaces or other non-URLable characters with the reasonable expectation that these arrive at the destination service as-is. But they don't.
Starting here the template handles application/x-www-form-urlencoded and multipart/form-data using aiohttp.FormData(). The default values on initializing this class unfortunately seem to mix some of the behavior appropriate to the form-urlencoded and form-data types, in particular defaulting to URL encoding for all fields, here. This has been noted as a problem before, for example in https://github.com/aio-libs/aiohttp/issues/3910
In theory, there is a very simple change that would fix this, by changing the template here:
- data = aiohttp.FormData()
+ data = aiohttp.FormData(quote_fields=False)
However, I suppose there are likely to be users of openapi-generator out there who are relying on the (arguably incorrect) existing behavior, and this easier change would break their use. So this may need to be made configurable instead.
I am happy to make the simpler but possibly breaking change if that is acceptable, or to discuss how/whether this could be made an option or otherwise worked around.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in modules/openapi-generator/src/main/resources/python/asyncio/rest.mustache around the multipart/form-data handling at line 227, and compare it with the application/x-www-form-urlencoded path. Determine whether quote_fields should be changed directly or exposed as a configurable option, then verify that generated asyncio clients preserve intended multipart filenames without unnecessarily breaking existing behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, backend-api-design
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100