Item12991: Trying to attach a file with a filename that contains quotes (") results in spurious error

I am trying to attach a file named

Settings for the "FRITZ!Box Fon WLAN 7390".pdf

This is a legal filename on ext4.

Fowswiki says (I added the single quotes for clarity):

Attention

Either you did not specify a file name, or the file you are trying to upload 'Settings for the \' has no content. You may not upload an empty file.

Please go back in your browser and check again. 

Evidently escaping goes haywire.

-- DavidTonhofer - 17 Aug 2014

This error appears to be deep in CGI I suspect. Dumping the initial CGI object, the backslash has been doubled, so it's no longer acting as an escape.

Here is a dump of the CGI object right after it's created:

                   '.tmpfiles' => {
                                    '*Fh::fh00001\\' => {
                                                          'info' => {
                                                                      'Content-Type' => 'application/pdf',
                                                                      'Content-Disposition' => 'form-data; name="filepath"; filename="\\"FRITZ!Box Fon WLAN 7390\\".pdf"'
                                                                    },
                                                          'hndl' => ${$VAR1}->{'param'}->{'filepath'}->[0],
                                                          'name' => bless( do{\(my $o = '/usr/tmp/CGItemp17929')}, 'CGITempFile' )
                                                        }
                                  },
  

Dumped in Engine/CGI.pm in prepareBodyParameters.

Wireshark trace shows a single backslash escaped ", so the doubling of the escaping backslash causes the issue. Not sure where that gets doubled.

Tried to see if I could recreate with Chromium, and the browser treats the " " as delimiters, stripping them and the trailing .pdf, so I can't even test with chromium.

-- GeorgeClark - 02 Dec 2014

Commenting is disabled while not logged in