python / python/cpython

email.message.get_filename() returning not a filename

Open
#101,932 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

docs stdlib topic-email type-bug
Dominant language
Python
Stars
77.2k
Forks
36k
PR merge metrics
PR metrics pending

Description

Bug report

https://docs.python.org/3/library/cgi.html says that the cgi mudule is deprecated and "The FieldStorage class can typically be replaced with ... the email.message module or multipart for POST and PUT."

An HTML form with a file input field must be transmitted as multipart/form-data. Every input field corresponds to a part of that multipart content. The only way to distinguish a file input from another input is via the filename. A file input comes with a filename, while other inputs don't.

The obvious way to check the filename of a part is via the get_filename() function. But its documentation says: "If the header does not have a filename parameter, this method falls back to looking for the name parameter on the Content-Type header." That leaves the function unusable for checking whether a filename is set, because every HTML input field has a name attribute, and therefore the function returns a supposed filename for all input fields, no matter whether they are files or not.

As a workaround, the result of the get_content_disposition() function can be parsed for a filename attribute, but that's unnecessarily complicated and error-prone. That's not what I would expect from a suggested replacement for a module that didn't require any low-level hacking.

For those reasons, the get_filename() function should only return the filename, not the input name. Or the email.message module shouldn't be suggested as a replacement for the FieldStorage class.

Your environment

Currently working with python 3.9 on an Apache webserver

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the email.message module and the get_filename() documentation, comparing its filename and name parameter behavior with the cgi.FieldStorage replacement guidance. Confirm the expected behavior for multipart/form-data parts with and without filenames, then update the relevant behavior and tests so get_filename() does not return an input name as a filename.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.