mime/multipart: permit empty file name

Fixes #19183

Change-Id: I11502d855f5b521b03ed7a63a990cca2d0ed4083
Reviewed-on: https://go-review.googlesource.com/70931
Reviewed-by: Ian Lance Taylor <iant@golang.org>

2 files changed, 28 insertions, 1 deletions

diff --git a/src/mime/multipart/formdata.go b/src/mime/multipart/formdata.go
index 832d0ad693..2a4ebdd4a0 100644
--- a/src/mime/multipart/formdata.go
+++ b/src/mime/multipart/formdata.go
@@ -58,7 +58,8 @@ func (r *Reader) readForm(maxMemory int64) (_ *Form, err error) {
 
 		var b bytes.Buffer
 
-		if filename == "" {
+		_, hasContentTypeHeader := p.Header["Content-Type"]
+		if !hasContentTypeHeader && filename == "" {
 			// value, store as string in memory
 			n, err := io.CopyN(&b, p, maxValueBytes+1)
 			if err != nil && err != io.EOF {
diff --git a/src/mime/multipart/formdata_test.go b/src/mime/multipart/formdata_test.go
index 979ae5c4e1..69333d3d0d 100644
--- a/src/mime/multipart/formdata_test.go
+++ b/src/mime/multipart/formdata_test.go
@@ -38,6 +38,23 @@ func TestReadForm(t *testing.T) {
 	fd.Close()
 }
 
+func TestReadFormWithNamelessFile(t *testing.T) {
+	b := strings.NewReader(strings.Replace(messageWithFileWithoutName, "\n", "\r\n", -1))
+	r := NewReader(b, boundary)
+	f, err := r.ReadForm(25)
+	if err != nil {
+		t.Fatal("ReadForm:", err)
+	}
+	defer f.RemoveAll()
+
+	fd := testFile(t, f.File["hiddenfile"][0], "", filebContents)
+	if _, ok := fd.(sectionReadCloser); !ok {
+		t.Errorf("file has unexpected underlying type %T", fd)
+	}
+	fd.Close()
+
+}
+
 func testFile(t *testing.T, fh *FileHeader, efn, econtent string) File {
 	if fh.Filename != efn {
 		t.Errorf("filename = %q, want %q", fh.Filename, efn)
@@ -68,6 +85,15 @@ const (
 	boundary      = `MyBoundary`
 )
 
+const messageWithFileWithoutName = `
+--MyBoundary
+Content-Disposition: form-data; name="hiddenfile"; filename=""
+Content-Type: text/plain
+
+` + filebContents + `
+--MyBoundary--
+`
+
 const message = `
 --MyBoundary
 Content-Disposition: form-data; name="filea"; filename="filea.txt"