FormFeature forces uploaded files to specify a filename directive in Content-Disposition header
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues - I couldn't add my input to it due to it being locked down to just collaborators, see https://github.com/dotnet/aspnetcore/issues/19295
### Describe the bug
We're running into issues uploading files that lack a filename directive, as they get treated as form data instead of files.
This causes them to be buffered into memory which can cause performance issues for large files, whereas when they contain a filename directive they are buffered to disk at `ASPNETCORE_TEMP ` if they exceed 64KB. We don't have control over the clients uploading these files, so we have to cater to both cases.
We currently use InputFormatters to parse the request before it reaches the controller, trying to support file uploads that lack the filename directive would require special handling such as:
```
const string sectionName = "fileUpload";
var provider = await HttpContext.Request.ReadFormAsync(HttpContext.RequestAborted);
if (provider.Files[sectionName] is { } file) // filename directive supplied
{
await using var stream = file.OpenReadStream();
// do something
}
else if (provider.TryGetValue(sectionName, out var values)) // filename directive not supplied, get from form data
{
var value = values.First();
// TODO: convert to byte stream...
}
```
The opinionated line of code is https://github.com/dotnet/aspnetcore/blob/2ce54c68b2abfa66974a4e75cf80e61203180ce4/src/Http/Http/src/Features/FormFeature.cs#L219
To workaround this, we've disabled the in-built behaviour, and essentially copied the FormFeature implementation, with a change so all sections are treated as IFormFile with readable Streams.
The RFC 7578 spec states that a filename isn't mandatory for file uploads see https://datatracker.ietf.org/doc/html/rfc7578#section-4.2. Likewise the MDN doc states it's optional https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition#filename
### Expected Behavior
IFormCollection.Files to contain files uploaded without the filename directive.
### .NET Version
v8.0.100
Contributor guide
Assessment
This issue has not been assessed yet.