| Subject: | at least 1 type of multi-part file upload is broken |
First off, thanks for your efforts on CGI::Simple!
tested with both perl 5.8.8 and 5.10.0
This bug is in the handling of multi-part form data relating to file
uploads. The version I first experienced this on was 1.106 but it still
exists in 1.112. Within _parse_multipart you'll find a line that looks like:
my ( $param ) = $unfold =~ m/form-data;\s+name="?([^\";]*)"?/;
The problem is that when the content is a file, either 'form-data' or
'file' are acceptable according to the spec. For reference, take a peek
at http://www.faqs.org/rfcs/rfc1867.html (search for 'disposition')
One possible fix is:
my ( $param ) = $unfold =~ m/(?:form-data|file);\s+name="?([^\";]*)"?/;
W3C specifies yet another variation where multiple files all under the
same form-field name are listed as 'multipart/mixed'
http://www.w3.org/TR/html401/interact/forms.html#h-17.13.4.2
Perhaps I'll provide a patch for this format as well, but right now I
don't have time.
cheers