Always quote name and filename in multipart/form-data Content-Disposition headers

[Copilot]

Ktor's multipart/form-data implementation conditionally quotes name and filename parameters only when they contain special characters (e.g., name=photo vs name="photo"). This breaks compatibility with servers like Elysia that strictly expect quoted values per common browser behavior.

Changes

• formDsl.kt: Replace escapeIfNeeded() with quote() for name and filename parameters
  • Line 40: name=${key.escapeIfNeeded()} → name=${key.quote()}
  • Line 275: filename=${filename.escapeIfNeeded()} → filename=${filename.quote()}
• Tests: Update expectations to reflect always-quoted parameters (4 files, 8 assertions)

Example

Before:

Content-Disposition: form-data; name=photo; filename=image.jpg

After:

Content-Disposition: form-data; name="photo"; filename="image.jpg"

This aligns with browser behavior (Chrome, Firefox, Safari) and RFC 7578's quoted-string format while remaining backward compatible with servers that accept either format.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dl.google.com
  • Triggering command: /usr/lib/jvm/temurin-21-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED -XX:+HeapDumpOnOutOfMemoryError -XX:+UseParallelGC -Xms2g -Xmx10g -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -cp /home/REDACTED/.gradle/wrapper/dists/gradle-9.1.0-bin/9agqghryom9wkf8r80qlhnts3/gradle-9.1.0/lib/gradle-daemon-main-9.1.0.jar -javaagent:/home/REDACTED/.gradle/wrapper/dists/gradle-9.1.0-bin/9agqghryom9wkf8r80qlhnts3/gradle-9.1.0/lib/agents/gradle-instrumentation-agent-9.1.0.jar org.gradle.launcher.daemon.bootstrap.GradleDaemon 9.1.0 (dns block)
  • Triggering command: ping -c 3 dl.google.com (dns block)
  • Triggering command: curl -I REDACTED (dns block)
• ge.jetbrains.com

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Client: Multipart upload doesn't work with some servers</issue_title>
<issue_description>elysiajs/elysia#1513

When Ktor sends a multipart form request, the name= field isn't quoted, which differs from the standard FormData behavior. Even though the standard didn't say they must be quoted strings, many server frameworks (e.g. elysia) expect it to be quoted, which causes elysia to ignore the field entirely.

Packet capture: Note that the FormData sent name="photo" while Ktor sent name=photo

JS Fetch FormData

POST /upload HTTP/1.1
x-instant-key: meowmeow
Content-Type: multipart/form-data; boundary=-WebkitFormBoundary074b68ff41eb4ad0bc81501198ed9954
Connection: keep-alive
User-Agent: Bun/1.2.21
Accept: */*
Host: localhost:3000
Accept-Encoding: gzip, deflate, br, zstd
Content-Length: 9409403

---WebkitFormBoundary074b68ff41eb4ad0bc81501198ed9954
Content-Disposition: form-data; name="id"

test-252
---WebkitFormBoundary074b68ff41eb4ad0bc81501198ed9954
Content-Disposition: form-data; name="owner_key"

1234
---WebkitFormBoundary074b68ff41eb4ad0bc81501198ed9954
Content-Disposition: form-data; name="photo"; filename="./UWU01721.JPG"
Content-Type: application/octet-stream

�����AExif

Ktor

POST /upload HTTP/1.1
Host: 172.16.0.212:3000
Content-Length: 14279723
x-instant-key: meowmeow
Accept: application/json
Accept-Charset: UTF-8
User-Agent: ktor-client
Content-Type: multipart/form-data; boundary=-748f4c8e-19eb394f-6d6c679e-74278686658a4a8c701fae79636dfd85372e904c-4

---748f4c8e-19eb394f-6d6c679e-74278686658a4a8c701fae79636dfd85372e904c-4
Content-Disposition: form-data; name=id
Content-Length: 36

e662d915-3ed6-4042-baca-861630ab65bc
---748f4c8e-19eb394f-6d6c679e-74278686658a4a8c701fae79636dfd85372e904c-4
Content-Disposition: form-data; name=owner_key
Content-Length: 4

1234
---748f4c8e-19eb394f-6d6c679e-74278686658a4a8c701fae79636dfd85372e904c-4
Content-Disposition: form-data; name=photo; filename=UWU01955.JPG
Content-Type: image/jpeg
Content-Length: 14166893

���ῄExif
```</issue_description>

## Comments on the Issue (you are @copilot in this section)

<comments>
</comments>

• Fixes Client: Multipart upload doesn't work with some servers #5157

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull Request Overview

This PR addresses a compatibility issue where Ktor's multipart/form-data implementation conditionally quotes parameters, causing failures with servers that expect quoted values. The fix ensures name and filename parameters are always quoted in Content-Disposition headers, aligning with browser behavior and RFC 7578.

Key changes:

• Changed escapeIfNeeded() to quote() for both name and filename parameters in formDsl.kt
• Updated 8 test assertions across 4 test files to expect quoted parameter values

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
ktor-client/ktor-client-core/common/src/io/ktor/client/request/forms/formDsl.kt	Core change: replaced conditional escaping with unconditional quoting for name (line 40) and filename (line 275) parameters
ktor-client/ktor-client-core/common/test/MultiPartFormDataContentTest.kt	Updated 5 test assertions to expect quoted name parameters
ktor-client/ktor-client-tests/common/test/io/ktor/client/tests/ContentTest.kt	Updated 1 test assertion to expect quoted name parameter
ktor-client/ktor-client-tests/common/test/io/ktor/client/tests/LoggingMockedTests.kt	Updated 1 test assertion to expect quoted name parameter

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.