email.message.get_filename() returning not a filename
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 77.2k
- Forks
- 36k
- PR merge metrics
- PR metrics pending
Description
Bug report
https://docs.python.org/3/library/cgi.html says that the cgi mudule is deprecated and "The FieldStorage class can typically be replaced with ... the email.message module or multipart for POST and PUT."
An HTML form with a file input field must be transmitted as multipart/form-data. Every input field corresponds to a part of that multipart content. The only way to distinguish a file input from another input is via the filename. A file input comes with a filename, while other inputs don't.
The obvious way to check the filename of a part is via the get_filename() function. But its documentation says: "If the header does not have a filename parameter, this method falls back to looking for the name parameter on the Content-Type header." That leaves the function unusable for checking whether a filename is set, because every HTML input field has a name attribute, and therefore the function returns a supposed filename for all input fields, no matter whether they are files or not.
As a workaround, the result of the get_content_disposition() function can be parsed for a filename attribute, but that's unnecessarily complicated and error-prone. That's not what I would expect from a suggested replacement for a module that didn't require any low-level hacking.
For those reasons, the get_filename() function should only return the filename, not the input name. Or the email.message module shouldn't be suggested as a replacement for the FieldStorage class.
Your environment
Currently working with python 3.9 on an Apache webserver
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the email.message module and the get_filename() documentation, comparing its filename and name parameter behavior with the cgi.FieldStorage replacement guidance. Confirm the expected behavior for multipart/form-data parts with and without filenames, then update the relevant behavior and tests so get_filename() does not return an input name as a filename.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100