Re: form-date with newline in filename

> On Jul 4, 2017, at 4:41 PM, Bill Moseley <[email protected]> wrote:
>=20
> I'm trying to understand if the Perl code is doing the right thing by =
placing a newline directly in the double-quoted filename in the =
Content-Disposition header.
>=20
> Even though it's probably a bad thing to do, POSIX allows newlines in =
filenames. Receiving systems, of course, must be careful how that =
filename is used -- but in this case it's never actually used in a =
filesystem (i.e. it's just considered metadata).=20
>=20
> The code below does a full round-trip successfully (meaning the =
newline in the filename is preserved), but that's all within Perl.=20
>=20
> I'm POSTing to a service written in Golang and that library is =
complaining about malformed headers.=20
>=20
> My question: Is HTTP::Request not escaping correctly or is Golang =
library not parsing correctly?
>=20
> use strict;
> use warnings;
> use HTTP::Request::Common;
> use HTTP::Response;
> use HTTP::Body;
> use Data::Dumper;
>=20
> my $filename =3D "name with\na newline";
>=20
> my $req =3D POST(
>     'http://example.com/post',
>     content_type =3D> 'form-data',
>     Content =3D> [
>         file =3D> [
>             $0,
>             $filename,
>         ],
>         one =3D> 1,
>         two =3D> 2,
>     ],
> );
>=20
> my $res =3D HTTP::Response->parse( $req->as_string );
> my $body =3D HTTP::Body->new( join( ' ' ,$res->content_type), =
$res->content_length );
> $body->add( $res->decoded_content );
> print Dumper $body->upload;
>=20
> Above returns:
>=20
> $VAR1 =3D {
>           'file' =3D> {
>                       'filename' =3D> 'name with
> a newline',
>                       'tempname' =3D> =
'/var/folders/sz/w4rntlpx76vcy5xrp441m0qw0000gn/T/6QNv98gd5B',
>                       'size' =3D> 561,
>                       'headers' =3D> {
>                                      'Content-Disposition' =3D> =
'form-data; name=3D"file"; filename=3D"name with
> a newline"',
>                                      'Content-Type' =3D> 'text/plain'
>                                    },
>                       'name' =3D> 'file'
>                     }
>         };
>=20
> It seems like header folding is no longer allowed, but I'm not clear =
that this is a case of header-folding:
>=20
> =
https://stackoverflow.com/questions/521275/how-to-escape-a-line-break-lite=
ral-in-the-http-header
>=20
> Or asked another way, is Perl or Golang breaking Postel's law?

Hi Bill,

Is it possible for you to print the actual outgoing headers?  With the =
newlines being involved, the order of the headers could make a =
difference here.

Best,

Olaf