dotnet / dotnet/aspnetcore

FormFeature forces uploaded files to specify a filename directive in Content-Disposition header

Open
#53,211 6 comments 1 reaction 0 assignees View on GitHub
area-networking
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues - I couldn't add my input to it due to it being locked down to just collaborators, see https://github.com/dotnet/aspnetcore/issues/19295

### Describe the bug

We're running into issues uploading files that lack a filename directive, as they get treated as form data instead of files.
This causes them to be buffered into memory which can cause performance issues for large files, whereas when they contain a filename directive they are buffered to disk at `ASPNETCORE_TEMP ` if they exceed 64KB. We don't have control over the clients uploading these files, so we have to cater to both cases.

We currently use InputFormatters to parse the request before it reaches the controller, trying to support file uploads that lack the filename directive would require special handling such as:
```
const string sectionName = "fileUpload";
var provider = await HttpContext.Request.ReadFormAsync(HttpContext.RequestAborted);
if (provider.Files[sectionName] is { } file) // filename directive supplied
{
await using var stream = file.OpenReadStream();
// do something
}
else if (provider.TryGetValue(sectionName, out var values)) // filename directive not supplied, get from form data
{
var value = values.First();
// TODO: convert to byte stream...
}
```

The opinionated line of code is https://github.com/dotnet/aspnetcore/blob/2ce54c68b2abfa66974a4e75cf80e61203180ce4/src/Http/Http/src/Features/FormFeature.cs#L219

To workaround this, we've disabled the in-built behaviour, and essentially copied the FormFeature implementation, with a change so all sections are treated as IFormFile with readable Streams.

The RFC 7578 spec states that a filename isn't mandatory for file uploads see https://datatracker.ietf.org/doc/html/rfc7578#section-4.2. Likewise the MDN doc states it's optional https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition#filename

### Expected Behavior

IFormCollection.Files to contain files uploaded without the filename directive.

### .NET Version

v8.0.100

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.