mime: use percent-escaping for multipart form field and file names

Until now, form field and file names where escaped using the
backslash-escaping algorithm defined for multipart mails. This commit
replaces this with the percent-escaping method for URLs.

As this may introduce incompatibilities with server-side applications, a
new libcurl option CURLOPT_MIME_OPTIONS with bitmask
CURLMIMEOPT_FORMESCAPE is introduced to revert to legacy use of
backslash-escaping. This is controlled by new cli tool option
--form-escape.

New tests and documentation are provided for this feature.

Reported by: Ryan Sleevi
Fixes #7789
Closes #7805
This commit is contained in:
Patrick Monnerat 2021-10-25 12:58:37 +02:00 committed by Daniel Stenberg
parent 6ec28eb687
commit b20b364764
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
23 changed files with 463 additions and 30 deletions

View file

@ -239,6 +239,7 @@ struct OperationConfig {
char *ftp_account; /* for ACCT */
char *ftp_alternative_to_user; /* send command if USER/PASS fails */
int ftp_filemethod;
long mime_options; /* Mime option flags. */
long tftp_blksize; /* TFTP BLKSIZE option */
bool tftp_no_options; /* do not send TFTP options requests */
bool ignorecl; /* --ignore-content-length */

View file

@ -138,6 +138,7 @@ static const struct LongShort aliases[]= {
{"$h", "retry-delay", ARG_STRING},
{"$i", "retry-max-time", ARG_STRING},
{"$k", "proxy-negotiate", ARG_BOOL},
{"$l", "form-escape", ARG_BOOL},
{"$m", "ftp-account", ARG_STRING},
{"$n", "proxy-anyauth", ARG_BOOL},
{"$o", "trace-time", ARG_BOOL},
@ -988,6 +989,12 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
return PARAM_LIBCURL_DOESNT_SUPPORT;
break;
case 'l': /* --form-escape */
config->mime_options &= ~CURLMIMEOPT_FORMESCAPE;
if(toggle)
config->mime_options |= CURLMIMEOPT_FORMESCAPE;
break;
case 'm': /* --ftp-account */
GetStr(&config->ftp_account, nextarg);
break;

View file

@ -193,6 +193,9 @@ const struct helptxt helptext[] = {
{"-F, --form <name=content>",
"Specify multipart MIME data",
CURLHELP_HTTP | CURLHELP_UPLOAD},
{" --form-escape",
"Escape multipart form field/file names using backslash",
CURLHELP_HTTP | CURLHELP_POST},
{" --form-string <name=string>",
"Specify multipart MIME data",
CURLHELP_HTTP | CURLHELP_UPLOAD},

View file

@ -1325,6 +1325,10 @@ static CURLcode single_transfer(struct GlobalConfig *global,
if(result)
break;
/* new in libcurl 7.81.0 */
if(config->mime_options)
my_setopt(curl, CURLOPT_MIME_OPTIONS, config->mime_options);
/* new in libcurl 7.10.6 (default is Basic) */
if(config->authtype)
my_setopt_bitmask(curl, CURLOPT_HTTPAUTH, (long)config->authtype);