filenames in multipart/form-data are not percent decoded

Description

For the following form:

<pre>
<?php
var_dump(PHP_VERSION);
var_dump($_FILES);
?>
</pre>

<form method="post" action="test.php" enctype="multipart/form-data">
<input type="file" name="some_file">

<button type="submit">Submit</button>
</form>

Uploading a file called ".txt in Firefox and Chrome

Resulted in this output:

string(5) "8.1.3"
array(1) {
  ["some_file"]=>
  array(6) {
    ["name"]=>
    string(7) "%22.txt"
    ["full_path"]=>
    string(7) "%22.txt"
    ["type"]=>
    string(10) "text/plain"
    ["tmp_name"]=>
    string(14) "/tmp/phpWl5h5S"
    ["error"]=>
    int(0)
    ["size"]=>
    int(0)
  }
}

But I expected this output instead:

string(5) "8.1.3"
array(1) {
  ["some_file"]=>
  array(6) {
    ["name"]=>
    string(5) "".txt"
    ["full_path"]=>
    string(5) "".txt"
    ["type"]=>
    string(10) "text/plain"
    ["tmp_name"]=>
    string(14) "/tmp/phpWl5h5S"
    ["error"]=>
    int(0)
    ["size"]=>
    int(0)
  }
}

Because I wasn't sure about the correct behavior myself I've checked with #curl on irc.libera.chat. In the replies I got the following references:

• https://daniel.haxx.se/blog/2021/11/13/fun-multipart-form-data-inconsistencies/
• https://github.com/curl/curl/issues/7789

RFC 7578#2 specifies percent-encoding for use in HTTP

So nowadays special characters, specifically the double quote (") are percent-encoded instead of backslash-encoded and PHP should properly decode those, like it already does for backslash encoding.

PHP Version

8.1.3

Operating System

Docker on Ubuntu 20.04

Beginne damit, den mit PHP 8.1.3 beschriebenen multipart/form-data-Upload nachzustellen, wobei ein Dateiname verwendet wird, der ein doppeltes Anführungszeichen enthält, und untersuche die resultierenden name- und full_path-Werte in $_FILES. Vergleiche die Behandlung der Prozentkodierung mit dem bestehenden Backslash-kodierten Verhalten; als erledigt gilt die Aufgabe, wenn beide Felder den dekodierten Dateinamen enthalten.