Unnecessary quotes around encoded filename* parameter

[xanto521]

Describe the bug
When I was using this app, I found that the file name I uploaded in the form would have a double quote symbol in the file name obtained in the back end

Screenshots
this is the app ui

this is python flask function request.files.get() get

Why is there a double quote after the file name?

App information:

• App Type :
  Postman for windows desktop
• Postman Version
  7.24.0
• OS:
  windows 10 Professional version 1909

[codenirvana]

@a66298458 This doesn't look like an issue from Postman as it forwards the filename as-is.
You can confirm this by checking the filename= attribute sent in the raw log of the Postman console.

[xanto521]

@a66298458 This doesn't look like an issue from Postman as it forwards the filename as-is.
You can confirm this by checking the filename= attribute sent in the raw log of the Postman console.

@codenirvana
when i use web ui to upload file , there is no this problem

when i use Progress Telerik Fiddler Web Debugger to check data, i find a different place

this is the form data from web ui upload

this is the form data from postman upload

i think this is the key of the problem, but i can't find how to fixed that.

[codenirvana]

@a66298458 I see no issue in the Content-Disposition headers and the filename is set correctly.
Probably, the server is not able to process the filename* attribute which is added because of the non-ASCII file name.

Which server/form-data body-parser are you using to process this?
Check if uploading a filename with just ASCII characters works fine for you.

[xanto521]

@codenirvana i use python flask webserver , the api is request.files.get('upload_file')

from flask import request
request.files.get('upload_file')

[codenirvana]

@a66298458 I tried reproducing this issue using a flask server and looks like its body-parser is not able to process the filename* attribute in Content-Disposition header.
Also, the library which is used internally recommends using the Unicode characters in the filename.

Closing this issue as we are already tracking this feature request of disabling the filename* attribute here: #8308

[itsjef]

@codenirvana I'm having this issue too. It happens specially when uploading a file whose name contains non-ASCII character (blue circle). Uploading from web-form or command line (using cURL or httpie) is fine.

App info:

• Postman for windows desktop
• Postman Version: v7.25.2
• OS: Windows 10

[itsjef]

Looks like it happens specially to Flask and libraries built on top of it (Eve, Flask-RESTful...). I created another server with Sanic and the filename returned correctly. :)

[codenirvana]

@itsjef As mentioned in #8537 (comment), Postman implements RFC 6266 which introduces this new filename * disposition parameter for Non-ASCII file names.

A lot of body-parsers don't support this yet but if you check the Content-Disposition header set by Postman, it includes both filename and filename* parameters for backward compatibility.

Content-Disposition: form-data; name="file"; filename="你好.xlsx"; filename*="UTF-8''%E4%BD%A0%E5%A5%BD.xlsx"

But looks like Flask's body-parser has a different way to extract the filename from the Content-Disposition header.

We are already tracking a feature request #8308 which will allow you to disable filename * addition.

[obfusk]

Actually, I think it is a bug in postman. Looking at the example:

Content-Disposition: form-data; name="file"; filename="你好.xlsx"; filename*="UTF-8''%E4%BD%A0%E5%A5%BD.xlsx"

And looking at the relevant RFCs (https://tools.ietf.org/html/rfc6266 & https://tools.ietf.org/html/rfc5987), I notice that filename*= does not support quoted-string values -- only percent-encoding -- whereas the example combines both. When removing the non-RFC-compliant quotes, the example seems to work just fine with flask:

Content-Disposition: form-data; name="file"; filename="你好.xlsx"; filename*=UTF-8''%E4%BD%A0%E5%A5%BD.xlsx

[arlemi]

We had to delay the release of the app, I'm reopening this issue for now and will close it again once 7.35 is widely available. 🙂