multipart/form-data filename="" not handled as file

[j@…]

Django does not parse file uploads with empty filename as file objects in multipart/form-data requests.
This happens currently if you try to upload a Blob in Firefox 4 (​https://bugzilla.mozilla.org/show_bug.cgi?id=649150)
Firefox sends this:

Content-Disposition: form-data; name="fieldname"; filename=""
Content-Type: content/type
DATA

Reading the related RFCs there is no mention that filename="" is not allowed and the existence of the filename parameter should be enough to treat it as a file.
looking at django/http/multipartparser.py
165ff

                    file_name = disposition.get('filename')
                    if not file_name:
                        continue

this would need to set a default filename instead of bailing out
(i.e. if file_name == : file_name = 'data.bin)

590:

            if params.get('filename'):

this would need to check

if 'filename' in params:

[j@…]

setting file_name to None instead of default value also works. with this patch django is able to handle Blob FormData send by Firefox 4.0

[Carl Meyer]

Patch doesn't look quite right, based on the description - if there is no filename parameter it would be None, and the current code would skip it (continue) but the new could would not.

[j@…]

skip file creation if filename is not set

[Aymeric Augustin]

Change UI/UX from NULL to False.

[Hridesh MG]

Can confirm that this is still reproducible, I've written the following test that can be added to tests/requests_tests.py

    def test_POST_multipart_with_empty_filename(self):
        payload = FakePayload(
            "\r\n".join(
                [
                    f"--{BOUNDARY}",
                    'Content-Disposition: form-data; name="File"; filename=""',
                    "Content-Type: application/octet-stream",
                    "",
                    "DATA",
                    f"--{BOUNDARY}--",
                ]
            )
        )
        request = WSGIRequest(
            {
                "REQUEST_METHOD": "POST",
                "CONTENT_TYPE": MULTIPART_CONTENT,
                "CONTENT_LENGTH": len(payload),
                "wsgi.input": payload,
            }
        )
        self.assertEqual(len(request.FILES), 1)
        self.assertIsInstance((request.FILES["File"]), InMemoryUploadedFile)

[Hridesh MG]

​PR