232993 - attachments with spaces in names don't work

Status: RESOLVED FIXED

(Bugzilla :: Attachments & Requests, defect)

Description

[Marc Bejarano]

User-Agent:       
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113

if you upload an attachment like "bug info.zip", when a user downloads this
attachment, it will be named "bug".

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

Comment 1

[Patrick]

wfm on XP pro & moz 2004020308 when i send myself a "test file.zip".

Reporter: Can you reproduce this bug? And what mailer is used on by the
receiving party? 

Comment 2

[Marc Bejarano]

patrick: i'm not sure i understand what you are talking about.  this bug is
about bugzilla attachments.  i'll create one on this bug so you see what i mean.
 no "mailer" is involved.

Comment 3

[Marc Bejarano]

Attachment: test attachment with spaces in filename

added a test attachment called "filename with spaces.txt"

Comment 4

[Dave Miller [:justdave]]

Confirmed.  If I view the attachment on this bug and do "Save Page As..."
Mozilla offers me "filename" for the default filename.

Comment 5

[Marc Bejarano]

now that i changed the mime-type to "application/octet-stream", it is even
easier to repro.  just click on the attachment and your browser will likely ask
you what to do with the file.

Comment 6

[Dave Miller [:justdave]]

OK, after reviewing RFC 2183 (http://www.isi.edu/in-notes/rfc2183.txt) which
covers the Content-Disposition header, I'm convinced that Bugzilla is in fact
generating the correct header, and Mozilla is interpreting it incorrectly.

Safari and Internet Explorer both get the entire filename, and don't truncate at
the space.

Comment 7

[Boris Zbarsky [:bzbarsky]]

> OK, after reviewing RFC 2183 (http://www.isi.edu/in-notes/rfc2183.txt) which
> covers the Content-Disposition header, I'm convinced that Bugzilla is in fact
> generating the correct header,

Oh, man.  This is after reading the RFC?  From that RFC:

     filename-parm := "filename" "=" value

The "value" token is not defined in that RFC, and the RFC normatively references
RFC 2045 for its definition.  RFC 2045 says:

     value := token / quoted-string
     token := 1*<any (US-ASCII) CHAR except SPACE, CTLs,
                 or tspecials>

In other words, you can't have spaces in the filename unless you quote the
filename.  Simple, no?  SPACE is very clearly excluded.

Also, note that RFC 2183 is in fact superceded by RFC 2231
(http://www.isi.edu/in-notes/rfc2231.txt), which removes the ascii-only
restriction but does not relax the space restriction.  In fact, implementing RFC
2231 correctly is near-impossible while ignoring the space restriction on
values.  Which is why we removed the code we had to ignore it when we
implemented support for RFC 2231. IE does NOT support RFC 2231; I have no idea
what Safari does.

This is _so_ a Bugzilla bug.  Just quote all filenames (and escape quotes in the
filename as necessary).

Comment 8

[Dave Miller [:justdave]]

When this was originally implemented, we had it quoted, and people complained that 
the quotes were getting included as part of the filename, so they got removed.

I missed the reference to RFC 2045 and assumed it wasn't being defined, but it
didn't say "quoted-value"....  and I remembered the above discussion about
browsers including the quotes in the filename.

Comment 9

[Boris Zbarsky [:bzbarsky]]

If there were quotes in the filename in Mozilla, please file a bug (and I will
be _very_ surprised, unless it's a really really old Mozilla version).  I'm
pretty certain IE handles quoted filenames fine.  No idea on Safari or Opera, again.

Comment 10

[Dave Miller [:justdave]]

Safari and IE5 Mac handle the quotes fine (as does Mozilla).  Looking back at
our history, it was actually a Microsoft tech note that was pointed out that
said you weren't supposed to quote it. :)  We all know how well Microsoft likes
to follow the standards. :)  I don't have access to try it on a PC to see what
the Windows version of IE does, but I've seen enough to know we should probably
fix it anyway. :)

Comment 11

[Dave Miller [:justdave]]

Attachment: Patch

I don't like this personally because it doesn't do anything for filenames with
quotes in the filename, but it's the same quoting that's done in the
Content-type header.  Anyone know the correct method to escape quotes within a
Content disposition value?

/me goes off to dig through RFC2045

Comment 12

[Boris Zbarsky [:bzbarsky]]

It's not there; the definition of quoted-string is imported from RFC 822.  It is:

     quoted-string = <"> *(qtext/quoted-pair) <">; Regular qtext or
                                                 ;   quoted chars.
where we have:

     qtext       =  <any CHAR excepting <">,     ; => may be folded
                     "\" & CR, and including
                     linear-white-space>
     quoted-pair =  "\" CHAR                     ; may quote any char

In other words,

Content-disposition: attachment; filename="A file with \"quotes\" in the name"

Comment 13

[Dave Miller [:justdave]]

OK, RFC2045 says value = quoted-string, and refers to RFC822, which says
(relevant pieces snagged and not necessarily displayed in order)

     quoted-string = <"> *(qtext/quoted-pair) <">; Regular qtext or
                                                 ;   quoted chars.

     qtext       =  <any CHAR excepting <">,     ; => may be folded
                     "\" & CR, and including
                     linear-white-space>

     quoted-pair =  "\" CHAR                     ; may quote any char

     linear-white-space =  1*([CRLF] LWSP-char)  ; semantics = SPACE
                                                 ; CRLF => folding

     LWSP-char   =  SPACE / HTAB                 ; semantics = SPACE

Now that's not exactly straightforward, but seems to imply to me that quotes
within the filename should be escaped with \ and \ characters should also be
escaped with \.

Is my interpretation correct?

Comment 14

[Dave Miller [:justdave]]

OK, I'll take bz's comment that I midaired with as an agreement with that
interpretation. :)

Comment 15

[Dave Miller [:justdave]]

Attachment: Patch v2

Comment 16

[Myk Melez [:myk] [@mykmelez]]

Comment on attachment 140558 [details] [diff] [review]
Patch v2

Works, looks good. r=myk

Comment 17

[Dave Miller [:justdave]]

Checking in attachment.cgi;
/cvsroot/mozilla/webtools/bugzilla/attachment.cgi,v  <--  attachment.cgi
new revision: 1.50; previous revision: 1.49
done

Comment 18

[Dave Miller [:justdave]]

*** Bug 233824 has been marked as a duplicate of this bug. ***

Comment 19

[czy]

I use the bugzilla 2.18.1 .
the attachment.cgi is
 # Return the appropriate HTTP response headers.
    $filename =~ s/^.*[\/\\]//;
    my $filesize = length($thedata);

    # escape quotes and backslashes in the filename, per RFCs 2045/822
    $filename =~ s/\\/\\\\/g; # escape backslashes
    $filename =~ s/"/\\"/g; # escape quotes

    print Bugzilla->cgi->header(-type=>"$contenttype; name=\"$filename\"",
                                -content_disposition=> "inline; 
filename=\"$filename\"",
                                -content_length => $filesize);

when I upload the file contain the space as "aa bb.txt",it will error and the 
message is "You did not specify a file to attach.  ".
how can i do?

Comment 20

[czy]

Attachment: the the space attachement.trc

Comment 21

[czy]

(In reply to comment #20)
> Created an attachment (id=199041) [edit]
> the the space attachement.trc

I find if I upload the file with the mozilla ,it will be success.
but if I use the IE ,it will be fail.
How can I do?
thanks.