formpost: support quotes, commas and semicolon in file names

- document the double-quote and backslash need be escaped if quoting.
- libcurl formdata escape double-quote in filename by backslash.
- curl formparse can parse filename both contains '"' and ',' or ';'.
- curl now can uploading file with ',' or ';' in filename.

Bug: http://curl.haxx.se/bug/view.cgi?id=1171

4 files changed, 117 insertions, 4 deletions

diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
index 89c96ce13..d2a9be1b6 100644
--- a/tests/data/Makefile.am
+++ b/tests/data/Makefile.am
@@ -75,7 +75,7 @@ test1094 test1095 test1096 test1097 test1098 test1099 test1100 test1101	\
 test1102 test1103 test1104 test1105 test1106 test1107 test1108 test1109	\
 test1110 test1111 test1112 test1113 test1114 test1115 test1116 test1117	\
 test1118 test1119 test1120 test1121 test1122 test1123 test1124 test1125	\
-test1126 test1127 test1128 test1129 test1130 test1131 test1132 \
+test1126 test1127 test1128 test1129 test1130 test1131 test1132 test1133 \
 test1200 test1201 test1202 test1203 test1204 test1205 test1206 test1207 \
 test1208 test1209 test1210 test1211 \
 test1220 test1221 test1222 test1223 \
diff --git a/tests/data/test1133 b/tests/data/test1133
new file mode 100644
index 000000000..733793114
--- /dev/null
+++ b/tests/data/test1133
@@ -0,0 +1,95 @@
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP FORMPOST
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 200 OK

+Date: Thu, 09 Nov 2010 14:49:00 GMT

+Server: test-server/fake

+Content-Length: 10

+

+blablabla
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+ <name>
+HTTP RFC1867-type formposting with filename contains ',', ';', '"'
+ </name>
+ <command>
+http://%HOSTIP:%HTTPPORT/we/want/1133 -F "file=@\"log/test1133,a\\\"nd;.txt\";type=mo/foo;filename=\"faker,and;.txt\"" -F 'file2=@"log/test1133,a\"nd;.txt"' -F 'file3=@"log/test1133,a\"nd;.txt";type=m/f,"log/test1133,a\"nd;.txt"'
+</command>
+# We create this file before the command is invoked!
+<file name=log/test1133,a"nd;.txt>
+foo bar
+This is a bar foo
+bar
+foo
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<strip>
+^(User-Agent:|Content-Type: multipart/form-data;|Content-Type: multipart/mixed, boundary=|-------).*
+</strip>
+<protocol>
+POST /we/want/1133 HTTP/1.1

+User-Agent: curl/7.10.4 (i686-pc-linux-gnu) libcurl/7.10.4 OpenSSL/0.9.7a ipv6 zlib/1.1.3

+Host: %HOSTIP:%HTTPPORT

+Accept: */*

+Content-Length: 967

+Expect: 100-continue

+Content-Type: multipart/form-data; boundary=----------------------------24e78000bd32

+

+------------------------------24e78000bd32

+Content-Disposition: form-data; name="file"; filename="faker,and;.txt"

+Content-Type: mo/foo

+

+foo bar
+This is a bar foo
+bar
+foo
+

+------------------------------24e78000bd32

+Content-Disposition: form-data; name="file2"; filename="test1133,a\"nd;.txt"

+Content-Type: text/plain

+

+foo bar
+This is a bar foo
+bar
+foo
+

+------------------------------24e78000bd32

+Content-Disposition: form-data; name="file3"

+Content-Type: multipart/mixed, boundary=----------------------------7f0e85a48b0b

+

+Content-Disposition: attachment; filename="test1133,a\"nd;.txt"

+Content-Type: m/f

+

+foo bar
+This is a bar foo
+bar
+foo
+

+Content-Disposition: attachment; filename="test1133,a\"nd;.txt"

+Content-Type: text/plain

+

+foo bar
+This is a bar foo
+bar
+foo
+

+------------------------------24e78000bd32--

+</protocol>
+</verify>
+</testcase>
diff --git a/tests/data/test39 b/tests/data/test39
index a2e1441d1..1867b6081 100644
--- a/tests/data/test39
+++ b/tests/data/test39
@@ -26,7 +26,7 @@ http
 HTTP RFC1867-type formposting with filename= and type=
  </name>
  <command>
-http://%HOSTIP:%HTTPPORT/we/want/39 -F name=daniel -F tool=curl --form-string "str1=@literal" --form-string "str2=<verbatim;type=xxx/yyy" -F "file=@log/test39.txt;type=moo/foobar;filename=fakerfile" -F file2=@log/test39.txt
+http://%HOSTIP:%HTTPPORT/we/want/39 -F name=daniel -F tool=curl --form-string "str1=@literal" --form-string "str2=<verbatim;type=xxx/yyy" -F "file=@log/test39.txt;type=moo/foobar;filename=fakerfile" -F file2=@log/test39.txt -F "file3=@\"log/test39.txt\";type=mo/foo;filename=\"f\\\\\\\\ak\\\\\\er,\\\\an\\d;.t\\\"xt\"" -F 'file4=@"log/test39.txt"; filename="A\\AA\"\"\\\"ZZZ"'
 </command>
 # We create this file before the command is invoked!
 <file name="log/test39.txt">
@@ -47,7 +47,7 @@ POST /we/want/39 HTTP/1.1
 User-Agent: curl/7.10.4 (i686-pc-linux-gnu) libcurl/7.10.4 OpenSSL/0.9.7a ipv6 zlib/1.1.3

 Host: %HOSTIP:%HTTPPORT

 Accept: */*

-Content-Length: 810

+Content-Length: 1184

 Expect: 100-continue

 Content-Type: multipart/form-data; boundary=----------------------------24e78000bd32

 

@@ -85,6 +85,24 @@ This is a bar foo
 bar
 foo
 

+------------------------------24e78000bd32

+Content-Disposition: form-data; name="file3"; filename="f\\\\ak\\\\er,\\an\\d;.t\"xt"

+Content-Type: mo/foo

+

+foo bar
+This is a bar foo
+bar
+foo
+

+------------------------------24e78000bd32

+Content-Disposition: form-data; name="file4"; filename="A\\AA\"\"\\\"ZZZ"

+Content-Type: text/plain

+

+foo bar
+This is a bar foo
+bar
+foo
+

 ------------------------------24e78000bd32--

 </protocol>
 </verify>
diff --git a/tests/getpart.pm b/tests/getpart.pm
index 58bb3e42c..92a237830 100644
--- a/tests/getpart.pm
+++ b/tests/getpart.pm
@@ -56,7 +56,7 @@ sub getpartattr {
             $inside++;
             my $attr=$1;
 
-            while($attr =~ s/ *([^=]*)= *(\"([^\"]*)\"|([^\"> ]*))//) {
+            while($attr =~ s/ *([^=]*)= *(\"([^\"]*)\"|([^\> ]*))//) {
                 my ($var, $cont)=($1, $2);
                 $cont =~ s/^\"(.*)\"$/$1/;
                 $hash{$var}=$cont;