Implement spec-compliant newline normalization in form payloads
Categories
(Core :: DOM: Forms, task)
Tracking
()
Tracking | Status | |
---|---|---|
firefox90 | --- | fixed |
People
(Reporter: andreu, Assigned: andreu)
References
Details
(Keywords: dev-doc-complete)
Attachments
(1 file)
Spec PRs: https://github.com/whatwg/html/pull/6282, https://github.com/whatwg/html/pull/6287 (still under review)
Test PRs: https://github.com/web-platform-tests/wpt/pull/27142, https://github.com/web-platform-tests/wpt/pull/26740 (still under review)
The HTML spec is changing the way form payloads are handled to be more specific and match implementations better, in particular around newline normalization and escaping in multipart/form-data payloads.
https://github.com/whatwg/html/pull/6282 specifies the exact escaping implementations must use for multipart/form-data forms: percent-encoding newlines and double quotes. This goes against Firefox's behavior of replacing newlines with a space and escaping double quotes with a backslash. See the tests FileAPI/file/send-file-form-controls.html
and FileAPI/file/send-file-form-punctuation.html
.
https://github.com/whatwg/html/pull/6287 changes the way newline normalization works: for multipart/form-data
, the spec used to require that form entries which originated from forms were normalized (names and string values, but not filenames or file contents), but not entries added through other means (such as by populating a FormData
object from JS, or by modifying the entry list from JS through the formdata
event). Now all form entries must be normalized. See FileAPI/file/send-file-formdata-controls.html
.
Comment 1•4 years ago
•
|
||
John, is this something you want to fix (at least the changes that are no longer under review)? (And perhaps you're also interested in giving feedback on the proposed changes to these algorithms.)
Assignee | ||
Comment 2•4 years ago
|
||
This doesn't seem like a hard fix, so I'd like to take it up if that's okay. I would appreciate jdai's review here and on the WHATWG PR, though.
Updated•4 years ago
|
Assignee | ||
Comment 4•4 years ago
|
||
It seems like the HTML pull request is close to being merged, so John, if you have any feedback, please go ahead and give it.
![]() |
||
Updated•4 years ago
|
Assignee | ||
Comment 5•4 years ago
|
||
This commit also changes the way escapes work in multipart/form-data names and filenames.
Updated•4 years ago
|
Pushed by opettay@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/beece7a29ecd Update newline normalization in form payloads. r=smaug
Comment 8•3 years ago
|
||
Backed out for mochitest failures on test_ext_webrequest_upload.html.
Failure log: https://treeherder.mozilla.org/logviewer?job_id=340614157&repo=autoland
Backout link: https://hg.mozilla.org/integration/autoland/rev/1660127d222e1ddf9e7e89bff2c92eb73f471305
Assignee | ||
Comment 9•3 years ago
|
||
This revision had to land together with https://phabricator.services.mozilla.com/D108679, since that revision adds the changes needed to the multipart/form-data
parser in the WebExtensions API which are needed to get the same result as these changes on the serializer. See bug 1697292. I had linked both revisions, but maybe I got that wrong.
Comment 10•3 years ago
|
||
Pushed by opettay@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/3e05faaa217d Update newline normalization in form payloads. r=smaug
Comment 11•3 years ago
|
||
bugherder |
Assignee | ||
Updated•3 years ago
|
Updated•3 years ago
|
Description
•