| Subject: | [HTTP::Request::Common] Does not handle filenames containing " |
| Date: | Wed, 7 Nov 2007 00:22:29 -0800 (PST) |
| To: | bug-libwww-perl [...] rt.cpan.org |
| From: | Jacob J <waif [...] chaos2.org> |
The function form_data in HTTP::Request::Common (1.28) does not correctly
handle filenames containing the quote character ".
Here's a fix:
--- Common.pm 2007-08-05 07:39:26.000000000 -0700
+++ Common-new.pm 2007-11-07 00:20:39.000000000 -0800
@@ -134,6 +134,7 @@
$usename = $file;
$usename =~ s,.*/,, if defined($usename);
}
+ $usename =~ s/([\\\"])/\\$1/g if defined($usename); # escape quotes and backslashes
my $disp = qq(form-data; name="$k");
$disp .= qq(; filename="$usename") if $usename;
my $content = "";
================= end diff ================
Without this fix, headers similar to the following are produced:
--xYzZY
Content-Disposition: form-data; name="file"; filename="qq"pp"
Content-Type: text/plain
blah blah blah
--xYzZY--
(Note the filename field.)
Other info:
Perl v5.8.8 built for i686-linux
Linux 2.6.20.6
Thanks,
- Jacob Post