From cf409f7baba8a6ab865d9715e9a3ca11592400ea Mon Sep 17 00:00:00 2001 From: yhirose Date: Fri, 16 Oct 2026 23:52:15 -0400 Subject: [PATCH] Note how multipart names with backslashes are read name and filename are read as RFC 9110 quoted-strings, while browsers send a backslash as it is, so from a browser a value with "\\" in it arrives with a single backslash, and one ending in "\" is misread. --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index 34b7632c..b66a672c 100644 --- a/README.md +++ b/README.md @@ -726,6 +726,9 @@ auto safe = httplib::sanitize_filename(file.filename); This function strips path separators (`/`, `\`), null bytes, leading/trailing whitespace, and rejects `.` and `..`. Returns an empty string if the filename is unsafe. +> [!NOTE] +> `name` and `filename` are read as quoted-strings (RFC 9110 ยง5.6.4), where `\"` and `\\` stand for `"` and `\`. Browsers send a backslash as it is, so from a browser, a value with `\\` in it arrives with a single `\`, and one that ends in `\` is not read correctly. + ### Receive content with a content receiver ```cpp