filenames in multipart/form-data are not percent decoded

Description

For the following form:

<pre>
<?php
var_dump(PHP_VERSION);
var_dump($_FILES);
?>
</pre>

<form method="post" action="test.php" enctype="multipart/form-data">
<input type="file" name="some_file">

<button type="submit">Submit</button>
</form>

Uploading a file called ".txt in Firefox and Chrome

Resulted in this output:

string(5) "8.1.3"
array(1) {
  ["some_file"]=>
  array(6) {
    ["name"]=>
    string(7) "%22.txt"
    ["full_path"]=>
    string(7) "%22.txt"
    ["type"]=>
    string(10) "text/plain"
    ["tmp_name"]=>
    string(14) "/tmp/phpWl5h5S"
    ["error"]=>
    int(0)
    ["size"]=>
    int(0)
  }
}

But I expected this output instead:

string(5) "8.1.3"
array(1) {
  ["some_file"]=>
  array(6) {
    ["name"]=>
    string(5) "".txt"
    ["full_path"]=>
    string(5) "".txt"
    ["type"]=>
    string(10) "text/plain"
    ["tmp_name"]=>
    string(14) "/tmp/phpWl5h5S"
    ["error"]=>
    int(0)
    ["size"]=>
    int(0)
  }
}

Because I wasn't sure about the correct behavior myself I've checked with #curl on irc.libera.chat. In the replies I got the following references:

• https://daniel.haxx.se/blog/2021/11/13/fun-multipart-form-data-inconsistencies/
• https://github.com/curl/curl/issues/7789

RFC 7578#2 specifies percent-encoding for use in HTTP

So nowadays special characters, specifically the double quote (") are percent-encoded instead of backslash-encoded and PHP should properly decode those, like it already does for backslash encoding.

PHP Version

8.1.3

Operating System

Docker on Ubuntu 20.04

Start by reproducing the multipart/form-data upload described with PHP 8.1.3, using a filename containing a double quote, and inspect the resulting $_FILES name and full_path values. Compare percent-encoded handling with the existing backslash-encoded behavior; done means both fields contain the decoded filename.