FileUpload.filename cut off multi-byte characters (only extension is left)

I'm just trying update my product's bottle.py 0.11 to 0.12; and found objects in Request.files changed to new class FileUpload from cgi.FieldStorage.

They are not compatibile and have difference with filename:

filename of cgi.FieldStorage returns client-side file name
filename of FileUpload returns SAFE-FILE-NAME for saving which cut off non-ASCII and path separator

Those changes make hardly problem in multi-byte culture. If user upload file with non-ASCII named file, we got only extension of filename with FileUpload.filename.

For example: あいうえお.txt v cut off non-ascii .txt v strip '.' txt

We can also use raw_filename insteadly, but

need to care 'raw' or 'not' of filename for simply display filename of user uploaded is nonsense.
filename of non-ASCII named become meaningless and less safe for name uniqueness.

For problem 1: Renaming raw_filename/filename to filename/safe_filename is most best solution, I think. Most of non-expert user use save method. Or use 'safe_' prefixed for saving. Thus security affect of this changes would be minimal.

FYI, as for my product, files are managed with sequence number. Filenames are stored on DB for user can identify them. so no need to make filename safe.

For problem 2: Apply percent or some other escaping instead of cut off, is suboptimal to continuing current way. This may also solve part of problem 1, escaped strings is a enough hint to use raw_filename.

Anyway, cutting off is bad idea and hope fix this. Naming file with only Japanese characters is very neutral for ordinaly people in Japan. Might be same in Chinese or other non-ASCII countries.

thanks

bottlepy / bottle

FileUpload.filename cut off multi-byte characters (only extension is left) #855