Daily updates from Odoo
Wednesday, July 23, 2025
1 change
New functionality added to Odoo
Adds test coverage for website forms when a submitted field name ends with a backslash. This helps prevent crashes caused by newer request-parsing behavior and keeps website form submissions reliable for unusual inputs.
Original PR description
In that case Werkzeug 3.0.4 and later will drop the entire name (following pallets/werkzeug#2939, cf pallets/werkzeug#3032), we'll end up with a field named `None` on the python side, and then…
In that case Werkzeug 3.0.4 and later will drop the entire name (following pallets/werkzeug#2939, cf pallets/werkzeug#3032), we'll end up with a field named `None` on the python side, and then dispatching will blow up because `None` is not a valid kwarg. The exact semantics of that case are unclear (see also curl/curl#7789), my reading is that [RFC 7578][1] specifies percent-encoding and thus that should be used when encoding and decoding, and `\` should be irrelevant because it's neither `%` nor `"` so it's not a metacharacter for multipart/form-data headers. However the [whatwg living standard][2] rejects full blown percent-encoding, and instead uses percent-encoding on just a highly restricted set of inputs (which includes neither `\` nor `%`). And while it seems like we should be able to ignore RFC 6266 (the content-disposition header) who's to say that there are no real-world deployments which follow its strictures? Meh. Backport from #219478 as I apparently missed this bit when updating #219300 [1]: https://datatracker.ietf.org/doc/html/rfc7578#section-2 [2]: https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data