[Webkit-unassigned] [Bug 233725] New: File inputs in non-multipart form submissions show up as string values in the formdata event

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Dec 1 14:13:55 PST 2021


https://bugs.webkit.org/show_bug.cgi?id=233725

            Bug ID: 233725
           Summary: File inputs in non-multipart form submissions show up
                    as string values in the formdata event
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Forms
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: andreu at andreubotella.com
                CC: cdumez at apple.com, wenson_hsieh at apple.com

When a form's entry list is constructed, file inputs are being added to the DOMFormData object as entries with File values only if the entry list is being constructed as part of a multipart/form-data form submission or through the FormData constructor – for urlencoded and text/plain form submissions, file inputs are added as entries with a string value consisting of the file's filename. Before r280310, this followed the spec: this filename conversion is part of "convert to a list of name-value pairs" (https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#convert-to-a-list-of-name-value-pairs), except done earlier in the form submission than the rest of the normalization in that algorithm, and there was no way to observe the difference because the DOMFormData object was never exposed to the user halfway through a form submission.

r280310 changed this by adding the formdata event, which fires at the end of the "construct the entry list" algorithm and can both inspect and modify the DOMFormData object. This means that it is now observable that file inputs in urlencoded and text/plain form submissions are encoded as their filenames, which goes against the spec. Additionally, any new File entries added to the DOMFormData object in that event will be skipped when building the form payload, which also shouldn't happen.

It looks like file inputs should always be added to DOMFormData as File values, and the conversion to a filename should happen in FormData::appendNonMultipartKeyValuePairItems, along with the rest of normalizations in "convert to a list of name-value pairs".

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20211201/916e6e6e/attachment.htm>


More information about the webkit-unassigned mailing list