#23047: Handle Extended Header Parameters Specified in RFC # 2231
-------------------------------------+-------------------------------------
Reporter: ceaess | Owner: nobody
Type: Bug | Status: new
Component: File | Version: 1.6
uploads/storage | Keywords: multipart, rfc
Severity: Normal | compliance, files
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
This ticket originates with a bug reported in Requests,
[https://github.com/kennethreitz/requests/issues/2117 here] but is
actually a bug in all versions of Django (and Rack, and more) with the
implementation of [http://tools.ietf.org/html/rfc2231#section-4 RFC #2231]
section 4 (from 1997). This was discussed tangentially in a previous
thread [https://code.djangoproject.com/ticket/20147 here] but not
addressed.
For example if someone tries to use a filename like {{{u'файл'}}}, this
should be sent to the server as
{{{filename*=utf-8''%D1%84%D0%B0%D0%B9%D0%BB}}}. This is not properly
parsed by Django and so it appears to not have a filename at all.
I don't advise immediately parsing and decoding the value because of
attacks that are possible through utf-7 and other character sets.
--
Ticket URL: <https://code.djangoproject.com/ticket/23047>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/049.ed581caa06db7de5a50a7e343e7d7f01%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
