mime/multipart: encode non-US-ASCII characters in Content-Disposition

[odeke-em]

I am coming here from CL https://go-review.googlesource.com/c/go/+/190217 where @pascaldekloe has submitted a change that makes *mime/multipart.Writer generate a "Content-Disposition" value after invoking mime.FormatMediaType instead of using a quote escaper.

In a comment https://go-review.googlesource.com/c/go/+/190217/1#message-b06f1016c7862f1d35ef7a12dc95fc4426a48178
@mattn asks

I don't have strong opinion. Just for the note. This make forcibly the filename encode
with rfc 6266. So older browser will not work after this change. Do we need to leave
a way to output raw-filenames?

This issue is to have a discussion, but I'll also loop in some security folks @mikesamuel @empijei, to help evaluate or just beware of the update.

[pascaldekloe]

http://test.greenbytes.de/tech/tc2231/

[bcmills]

CC @bradfitz @minux (although both of those owners seem to be away from GitHub at the moment)

[bcmills]

@pascaldekloe, what is the rationale for / impact of the proposed change?

Is this a feature request to support non-ASCII value for those names, or a bugfix for names that RFC requires the library is required to support?

Either way, why is there no corresponding documentation change in the CL? (Presumably the change widens the set of acceptable names, so the doc comment should probably mention which names are acceptable either way.)

[pascaldekloe]

Not sure what to say here. I was surprised by the sloppy escape and fixed it. No more HTTP violation with UTF-8 or control characters in the header.

[gopherbot]

Change https://golang.org/cl/189858 mentions this issue: mime/multipart: fix CreateFormFile when filename is UTF8

[mengzhuo]

Hmm... It seems to be a duplicate CL from me

[gopherbot]

Timed out in state WaitingForInfo. Closing.

(I am just a bot, though. Please speak up if this is a mistake or you have the requested information.)

[odeke-em]

Gopherbot this hasn't timed out.

[odeke-em]

Gopherbot, chill!

[pascaldekloe]

The problem is that label @bcmills.

[gopherbot]

Change https://golang.org/cl/190217 mentions this issue: multipart: encode non-US-ASCII characters in Content-Disposition