Skip Menu |
 

Preferred bug tracker

Please visit the preferred bug tracker to report your issue.

This queue is for tickets about the CGI CPAN distribution.

Report information
The Basics
Id: 17848
Status: resolved
Priority: 0/
Queue: CGI

People
Owner: Nobody in particular
Requestors: vvv [...] vsu.ru
Cc:
AdminCc:

Bug Information
Severity: Important
Broken in: (no value)
Fixed in: (no value)

Attachments


Subject: broken uploads because of incorerct Content-Disposition value parsing
Download (untitled) / with headers
text/plain 1016b
[we have already reported this bug via email to Lincoln D. Stein on 07 Jan 2006 but got no reply] there is a nasty bug in CGI.pm resulting in inability to receive the uploaded file. one of our CGI scripts accepts file uploads, and for some users it was producing strange results: from the CGI script it looked as if the file name was containing what was supposed to be the file content, and the file content was absent. it appeared to be due to the bug in CGI.pm which is fixed by the attached patch. i.e. the regular expression was expecting that the filename between the quotes should not contain a semicolon, while some of the files were containing a semicolon, e.g. a raw form submission contained this: ... -----------------------------14042802788933518161505795335 Content-Disposition: form-data; name="file"; filename="12 Källarback Variations.mp3" Content-Type: audio/mpeg ... -----------------------------14042802788933518161505795335 ... Please fix this in the mainstream version of CGI.pm
Subject: CGI.pm-upload-fix.diff
--- /usr/local/lib/perl5/5.8.7/CGI.pm.orig Fri Jan 6 22:16:55 2006 +++ /usr/local/lib/perl5/5.8.7/CGI.pm Fri Jan 6 22:19:04 2006 @@ -3251,11 +3251,11 @@ return; } - my($param)= $header{'Content-Disposition'}=~/ name="([^;]*)"/; + my($param)= $header{'Content-Disposition'}=~/ name="([^"]*)"/; $param .= $TAINTED; # Bug: Netscape doesn't escape quotation marks in file names!!! - my($filename) = $header{'Content-Disposition'}=~/ filename="([^;]*)"/; + my($filename) = $header{'Content-Disposition'}=~/ filename="([^"]*)"/; # Test for Opera's multiple upload feature my($multipart) = ( defined( $header{'Content-Type'} ) && $header{'Content-Type'} =~ /multipart\/mixed/ ) ?
Fixed in 3.17.


This service is sponsored and maintained by Best Practical Solutions and runs on Perl.org infrastructure.

Please report any issues with rt.cpan.org to rt-cpan-admin@bestpractical.com.