dotnet / dotnet/runtime

MultipartFormDataContent does not conform to RFC7578 4.2

Open
#121,484 6 comments 3 reactions 0 assignees View on GitHub
area-System.Net
Dominant language
C#
Stars
18.3k
Forks
5.6k
PR merge metrics
PR metrics pending

Description

### Description

According to [RFC7578 section 4.2](https://www.rfc-editor.org/rfc/rfc7578#section-4.2) the `filename=` and `filename*=` fields for the `Content-Disposition: form-data` header field must not be combined.

```
NOTE: The encoding method described in [[RFC5987](https://www.rfc-editor.org/rfc/rfc5987)], which would add a
"filename*" parameter to the Content-Disposition header field, MUST
NOT be used.
```

### Reproduction Steps

```
[Fact]
public async Task Test()
{
MultipartFormDataContent c = new MultipartFormDataContent();
c.Add(new StringContent("MyFileContent"), "name", "special€filename");
var str = await c.ReadAsStringAsync();

Assert.Contains("filename*=utf-8''special%E2%82%ACfilename", str);
Assert.DoesNotContain("filename=", str);
}
```

### Expected behavior

Either filename or filename* should be present

### Actual behavior

The provided test method produces an output like this:

```
--4a424cac-7519-4ce0-b0b8-cb117505a4c3
Content-Type: text/plain; charset=utf-8
Content-Disposition: form-data; name=name; filename="=?utf-8?B?c3BlY2lhbOKCrGZpbGVuYW1l?="; filename*=utf-8''special%E2%82%ACfilename

MyFileContent
--4a424cac-7519-4ce0-b0b8-cb117505a4c3--
```

### Regression?

_No response_

### Known Workarounds

_No response_

### Configuration

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.