Repository navigation
fix: escape backslashes in the filename when pushing a file - #2901
Draft
tonyandrewmeyer wants to merge 1 commit into
Draft
tonyandrewmeyer wants to merge 1 commit into
tonyandrewmeyer wants to merge 1 commit into
Conversation
Pebble reads the multipart Content-Disposition header with Go's mime.ParseMediaType, where a backslash in a quoted string escapes the next character if it's a tspecial. Only double quotes were escaped, so a path with a backslash before a tspecial arrived at Pebble as a different path, and a path ending in a backslash made the header unparsable. Escape backslashes as well, the same way Go's multipart.Writer does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
push()didn't escape backslashes in the multipartfilenameparameter, so Pebble treated a\before another special character as an escape:back\\slashwas written to the wrong path, andback\"slashor a name ending in\failed withAPIError: field name must be "files", got ""._encode_multipartnow escapes\before", which is what Go's ownmultipart.Writerdoes (and what Pebble uses when it sends files forpull).CR and LF in a path still aren't handled. They can't go in a quoted-string at all, and Go rejects them.
A property test of the multipart encoding (in #2869) found this. There's a unit test that checks the exact header bytes, and a real Pebble test that pushes and pulls a few awkward names.