Subject: Re: bug#65973: [PATCH] ; send filename, not full path, on EWW form submit

From: Jim Porter <[email-masked]>
Date: Tue, 5 Nov 2024 11:36:25 -0800

On 11/5/2024 9:08 AM, Eli Zaretskii wrote:
>> Cc: daniel watson <[email-masked]>, [email-masked]
>> From: Sebastián Monía
>>   <[email-masked]>
>> Date: Tue, 05 Nov 2024 09:34:46 -0500
>>
>>
>> /added Jim for visibility/
>>
>> This seems like something simple enough to merge.
>> Thoughts?
>>
>> ozzloy <[email-masked]> writes:
>>>   bump
>>>
>>>   On Wed, Sep 13, 2023 at 11:10 PM daniel watson <[email-masked]> wrote:
>>>
>>>   0. in one terminal, run this http server
>>>      https://git.sr.ht/~ozzloy/emacs-bug-63941/tree/master/item/server.py
>>>   1. in another terminal, run
>>>      socat -v tcp-listen:8086,fork tcp:localhost:8085
>>>   2. browse to the page with EWW,
>>>      M-x eww <ENTER> localhost:8086 <ENTER>
>>>   3. put the cursor on the word "Browse" <ENTER>
>>>   4. select any file to which you have read access for uploading
>>>   5. put cursor on "Submit" <ENTER>
>>>   6. observe the full path of the file is sent to the server.  this is
>>>      visible in both the python output and the socat output.
>>>
>>>   i'm including the diff inline to make it easier to review without
>>>   downloading the attached file.
> 
> I'd like some rationale for this change.  The original report never
> explains why sending the full absolute file name to the server is bad.

I see three possible reasons: 1) there could be (probably minor) privacy 
issues with sending the directory structure along to a server; 2) as far 
as I'm aware, other browsers only pass the "leaf" of the filename; 3) 
RFC 2813 says that *recipients* should ignore any directories:

    The receiving MUA SHOULD NOT respect any directory path information
    that may seem to be present in the filename parameter.  The filename
    should be treated as a terminal component only.  Portable
    specification of directory paths might possibly be done in the future
    via a separate Content-Disposition parameter, but no provision is
    made for it in this draft.

RFC 2813 is primarily about mail clients, but MDN suggests following it 
in a web context as well: 
<https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition>. 
So I think the RFC would suggest that it's *allowed* to send the 
directories in the "filename" field, but since the server is supposed to 
ignore it, there's no benefit to doing so.