Skip Menu |
 

Preferred bug tracker

Please visit the preferred bug tracker to report your issue.

This queue is for tickets about the CGI CPAN distribution.

Report information
The Basics
Id: 23823
Status: rejected
Priority: 9/
Queue: CGI

People
Owner: MARKSTOS [...] cpan.org
Requestors: wbardwel [...] curl.com
Cc:
AdminCc:

Bug Information
Severity: Important
Broken in: (no value)
Fixed in: (no value)



Subject: CGI.pm requires quotes for name= and filename= which is wrong
Date: Wed, 06 Dec 2006 00:05:12 -0500
To: bug-CGI.pm [...] rt.cpan.org
From: William Bardwell <bardwell [...] curl.com>
Download (untitled) / with headers
text/plain 338b
I am seeing it running 3.05, but the source for 3.25 looks the same. Content-Disposition: header parsing is requiring quotes around the values of parameters like name= and filename= which is not what the RFC calls for. Those can be quoted strings or tokens (aka strings that do not require quoting.) William Bardwell wbardwel@curl.com
Download (untitled) / with headers
text/plain 567b
On Wed Dec 06 00:05:30 2006, wbardwel@curl.com wrote: Show quoted text
> I am seeing it running 3.05, but the source for 3.25 looks > the same. Content-Disposition: header parsing is requiring > quotes around the values of parameters like name= and filename= > which is not what the RFC calls for. Those can be quoted > strings or tokens (aka strings that do not require quoting.) > > William Bardwell > wbardwel@curl.com
Thanks for the report, William. To move this forward, I'd like to a link to the relevant RFC, as well as an automated test which triggers the bug. Mark
Subject: Re: [rt.cpan.org #23823] CGI.pm requires quotes for name= and filename= which is wrong
Date: Wed, 22 Jul 2009 23:07:52 -0400
To: bug-CGI.pm [...] rt.cpan.org
From: William Bardwell <bardwell [...] curl.com>
Download (untitled) / with headers
text/plain 625b
A Content-Disposition RFC is: http://www.ietf.org/rfc/rfc2183.txt which has the production for filename as: filename-parm := "filename" "=" value The production for value is in: http://www.ietf.org/rfc/rfc2045.txt value := token / quoted-string token := 1*<any (US-ASCII) CHAR except SPACE, CTLs, or tspecials> But all RFC 822 values in headers are defined that way. (Not sure where to find the production for the name parameter for Content-Disposition.) For a test case, take any existing test case with a Content-Disposition and remove the quotes around the value for name and filename.
Download (untitled) / with headers
text/plain 240b
This issue has been copied to: https://github.com/leejo/CGI.pm/issues/49 please take all future correspondence there. This ticket will remain open but please do not reply here. This ticket will be closed when the github issue is dealt with.
I'm rejecting this on the grounds that: 1. It is an eight year old bug report with little useful information regarding the "correct" fix. Any fixes made to the parsing and/or generation of the Content-Disposition header will probably cause significant breaks to existing code using these routines. 2. I cannot find the definition for name param in the Content-Disposition Header RFC. In fact, i cannot find the definition for it in any of the below so there is no clear advice on whether or not this param can be a token or must be quoted: - http://www.ietf.org/rfc/rfc2183.txt - http://www.ietf.org/rfc/rfc2045.txt - http://www.ietf.org/rfc/rfc1867.txt (the examples in this one seems to imply it should be quoted) - http://www.ietf.org/rfc/rfc2388.txt 3. The parsing of the filename param in the code already allows unquoted filenames, i have updated the test case to cover this - be aware that if the value is not quoted then it cannot contain any of the tspecials, so there are cases where it must be quoted. Thanks! Lee.


This service is sponsored and maintained by Best Practical Solutions and runs on Perl.org infrastructure.

Please report any issues with rt.cpan.org to rt-cpan-admin@bestpractical.com.