Incorrect quoting in Content-Disposition headers?

[catlee]

I've having a hard time grokking the various RFCs, but I just came across a service that refused to parse Content-Disposition lines like this:

CONTENT-DISPOSITION: form-data; name=file; filename="upload.gpx"; filename*=utf-8''upload.gpx

But accepted this:

CONTENT-DISPOSITION: form-data; name="file"; filename="upload.gpx"; filename*=utf-8''upload.gpx

The only difference being the quoting of the name parameter. Is aiohttp doing the right thing here? Is there a way to force quoting to happen?

[kxepal]

According the spec:

     content-disposition = "Content-Disposition" ":"
                           disposition-type *( ";" disposition-parm )
     disposition-type = "attachment" | disp-extension-token
     disposition-parm = filename-parm | disp-extension-parm
     filename-parm = "filename" "=" quoted-string
     disp-extension-token = token
     disp-extension-parm = token "=" ( token | quoted-string )

Where token is:

    token          = 1*<any CHAR except CTLs or separators>
    separators     = "(" | ")" | "<" | ">" | "@"
                   | "," | ";" | ":" | "\" | <">
                   | "/" | "[" | "]" | "?" | "="
                   | "{" | "}" | SP | HT

So name=file satisfies requirement to be disp-extension-parm since both name and file are valid tokens.

[kxepal]

We can enforce quoting, however. It shouldn't cause any harm. But suddenly, you cannot enforce it without a patch.

With what service do you have such problem btw?

[catlee]

This is with Strava's upload API. I posted to their developer support forum as well:
https://groups.google.com/forum/#!topic/strava-api/onA_ANTsPY4

[asvetlov]

BTW SimpleCookie starting from Python 3.5 enforces quoting for cookie names

[asvetlov]

Fixed by #641

[lock]

This thread has been automatically locked since there has not been
any recent activity after it was closed. Please open a new issue for
related bugs.

If you feel like there's important points made in this discussion,
please include those exceprts into that new issue.