filenames in multipart/form-data are not percent decoded

Description

For the following form:

<pre>
<?php
var_dump(PHP_VERSION);
var_dump($_FILES);
?>
</pre>

<form method="post" action="test.php" enctype="multipart/form-data">
<input type="file" name="some_file">

<button type="submit">Submit</button>
</form>

Uploading a file called ".txt in Firefox and Chrome

Resulted in this output:

string(5) "8.1.3"
array(1) {
  ["some_file"]=>
  array(6) {
    ["name"]=>
    string(7) "%22.txt"
    ["full_path"]=>
    string(7) "%22.txt"
    ["type"]=>
    string(10) "text/plain"
    ["tmp_name"]=>
    string(14) "/tmp/phpWl5h5S"
    ["error"]=>
    int(0)
    ["size"]=>
    int(0)
  }
}

But I expected this output instead:

string(5) "8.1.3"
array(1) {
  ["some_file"]=>
  array(6) {
    ["name"]=>
    string(5) "".txt"
    ["full_path"]=>
    string(5) "".txt"
    ["type"]=>
    string(10) "text/plain"
    ["tmp_name"]=>
    string(14) "/tmp/phpWl5h5S"
    ["error"]=>
    int(0)
    ["size"]=>
    int(0)
  }
}

Because I wasn't sure about the correct behavior myself I've checked with #curl on irc.libera.chat. In the replies I got the following references:

• https://daniel.haxx.se/blog/2021/11/13/fun-multipart-form-data-inconsistencies/
• https://github.com/curl/curl/issues/7789

RFC 7578#2 specifies percent-encoding for use in HTTP

So nowadays special characters, specifically the double quote (") are percent-encoded instead of backslash-encoded and PHP should properly decode those, like it already does for backslash encoding.

PHP Version

8.1.3

Operating System

Docker on Ubuntu 20.04

首先，使用包含双引号的文件名，复现使用 PHP 8.1.3 描述的 multipart/form-data 上传，并检查生成的 $_FILES 中的 name 和 full_path 值。将百分号编码的处理与现有的反斜杠编码行为进行比较；完成的标准是两个字段都包含解码后的文件名。