wt/cpp-httplib
1
0 Fork 0
mirror of https://github.com/yhirose/cpp-httplib.git synced 2026-10-19 11:19:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Note how multipart names with backslashes are read

Browse Source 
name and filename are read as RFC 9110 quoted-strings, while browsers
send a backslash as it is, so from a browser a value with "\\" in it
arrives with a single backslash, and one ending in "\" is misread.
This commit is contained in:
yhirose committed 2026-10-16 23:52:15 -04:00
1 parent 26febe0769
commit cf409f7bab
1 file changed
+3
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3
View File
@@ -726,6 +726,9 @@ auto safe = httplib::sanitize_filename(file.filename);
This function strips path separators (`/`, `\`), null bytes, leading/trailing whitespace, and rejects `.` and `..`. Returns an empty string if the filename is unsafe. This function strips path separators (`/`, `\`), null bytes, leading/trailing whitespace, and rejects `.` and `..`. Returns an empty string if the filename is unsafe.
> [!NOTE]
> `name` and `filename` are read as quoted-strings (RFC 9110 §5.6.4), where `\"` and `\\` stand for `"` and `\`. Browsers send a backslash as it is, so from a browser, a value with `\\` in it arrives with a single `\`, and one that ends in `\` is not read correctly.
### Receive content with a content receiver ### Receive content with a content receiver
```cpp ```cpp