python / python/cpython

email.message.get_filename() returning not a filename

未關閉
#101,932 3 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

還沒有人認領這個 Issue。

docs stdlib topic-email type-bug
主要語言
Python
星號
77.2k
分支
36k
PR 合併指標
PR 指標待擷取

描述

Bug report

https://docs.python.org/3/library/cgi.html says that the cgi mudule is deprecated and "The FieldStorage class can typically be replaced with ... the email.message module or multipart for POST and PUT."

An HTML form with a file input field must be transmitted as multipart/form-data. Every input field corresponds to a part of that multipart content. The only way to distinguish a file input from another input is via the filename. A file input comes with a filename, while other inputs don't.

The obvious way to check the filename of a part is via the get_filename() function. But its documentation says: "If the header does not have a filename parameter, this method falls back to looking for the name parameter on the Content-Type header." That leaves the function unusable for checking whether a filename is set, because every HTML input field has a name attribute, and therefore the function returns a supposed filename for all input fields, no matter whether they are files or not.

As a workaround, the result of the get_content_disposition() function can be parsed for a filename attribute, but that's unnecessarily complicated and error-prone. That's not what I would expect from a suggested replacement for a module that didn't require any low-level hacking.

For those reasons, the get_filename() function should only return the filename, not the input name. Or the email.message module shouldn't be suggested as a replacement for the FieldStorage class.

Your environment

Currently working with python 3.9 on an Apache webserver

貢獻指南

開啟貢獻指南

從這裡開始

  1. 先讀完整個 Issue,再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫,在一個分支上完成修改。
  4. 送出 Pull Request,並在描述裡引用這個 Issue 編號。

研究方向

從 email.message 模組和 get_filename() 文件開始,將其 filename 和 name 參數的行為與 cgi.FieldStorage 替代指南進行比較。確認具有和不具有檔名的 multipart/form-data 部分的預期行為,然後更新相關行為和測試,使 get_filename() 不會將輸入名稱作為檔名傳回。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
python
領域
backend
Issue 類型
缺陷
難度
3/5
預估耗時
1-2 天
活躍度
停滯
描述清晰度
基本清楚
新手友好度
42/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。