Escape special characters in form field names

[labkey-nicka]

Rationale

Certain "special" characters (e.g., " ; = , \) can cause issues when not escaped in multipart/form-data in Tomcat. For example, the "name" of the property is extracted from:

form-data; name="field\"; filename="spread.xlsx";

is expected to be field\, however, it is parsed as field\"; filename="spread.xlsx"; because the backlash is recognized as escaping the " after field\. The fix is to escape the backslash like this:

form-data; name="field\\"; filename="spread.xlsx";

Unfortunately, it is not clear to me why we need to do this as it seems like the standard states that as long as the string is quoted (e.g., name"field\"; not name=field\;) which appears to be what we are receiving. This fix is currently targeted only for QueryUpdateForm which is used for our standard query insert/update forms.

Related Pull Requests

• Escape special characters in form field names #7033
• https://github.com/LabKey/limsModules/pull/1661
• Test updates to escape special characters in form field names testAutomation#2683
• https://github.com/LabKey/premiumModules/pull/353

Changes

• Update QueryUpdateForm.getFormFieldName() and getColumnByFormFieldName() to escape and account for special characters in form field names.
• Update QueryUpdateForm.getMultiPartFormFieldName() to make use of getFormFieldName() to get appropriate escaping.
• Update tests to use EscapeUtils.getFormFieldName().
• Add explicit regression test coverage.

Tasks 📍

• Manual Testing @labkey-tchad
• Needs Automation