Ticket #18004: 18004-multipartparser-r17813.diff

django/http/multipartparser.py

@@ -147 +147 @@
                 transfer_encoding = meta_data.get('content-transfer-encoding')
                 if transfer_encoding is not None:
                     transfer_encoding = transfer_encoding[0].strip()
-                field_name = force_unicode(field_name, encoding, errors='replace')
+                field_name = force_unicode(field_name, encoding, errors='strict')
 
                 if item_type == FIELD:
                     # This is a post field, we can just set it in the post
@@ -161 +161 @@
                         data = field_stream.read()
 
                     self._post.appendlist(field_name,
-                                          force_unicode(data, encoding, errors='replace'))
+                                          force_unicode(data, encoding, errors='strict'))
                 elif item_type == FILE:
                     # This is a file, use the handler...
                     file_name = disposition.get('filename')
                     if not file_name:
                         continue
-                    file_name = force_unicode(file_name, encoding, errors='replace')
+                    file_name = force_unicode(file_name, encoding, errors='strict')
                     file_name = self.IE_sanitize(unescape_entities(file_name))
 
                     content_type = meta_data.get('content-type', ('',))[0].strip()
@@ -243 +243 @@
                 # If it returns a file object, then set the files dict.
                 self._files.appendlist(force_unicode(old_field_name,
                                                      self._encoding,
-                                                     errors='replace'),
+                                                     errors='strict'),
                                        file_obj)
                 break
 

tests/regressiontests/file_uploads/tests.py

@@ -13 +13 @@
 from django.core.files.uploadedfile import SimpleUploadedFile
 from django.http.multipartparser import MultiPartParser
 from django.test import TestCase, client
-from django.utils import simplejson, unittest
+from django.utils import encoding, simplejson, unittest
 
 from . import uploadhandler
 from .models import FileModel, temp_storage, UPLOAD_TO
@@ -104 +104 @@
 
         self.assertEqual(response.status_code, 200)
 
+    def test_non_utf_post_data(self):
+        BIG5_STRING = u'test-0123456789_中文.jpg'
+
+        tdir = tempfile.gettempdir()
+
+        # This file contains chinese symbols in the name.
+        file1 = open(os.path.join(tdir, BIG5_STRING.encode('big5')), 'w+b')
+        file1.write('b' * (2 ** 10))
+        file1.seek(0)
+
+        self.assertRaises(
+            encoding.DjangoUnicodeDecodeError,
+            self.client.post,
+            '/file_uploads/unicode_name/',
+            {'file_unicode': file1}
+        )
+
+        file1.close()
+        try:
+            os.unlink(file1.name)
+        except:
+            pass
+
+        self.assertRaises(
+            encoding.DjangoUnicodeDecodeError,
+            self.client.post,
+            '/file_uploads/unicode_name/',
+            {BIG5_STRING.encode('big5'): 'string data'}
+        )
+
+        self.assertRaises(
+            encoding.DjangoUnicodeDecodeError,
+            self.client.post,
+            '/file_uploads/unicode_name/',
+            {'string data': BIG5_STRING.encode('big5')}
+        )
+
     def test_dangerous_file_names(self):
         """Uploaded file names should be sanitized before ever reaching the view."""
         # This test simulates possible directory traversal attacks by a