fix: Uploaded files with quoted names appear as %22 in chat

apps/meteor/app/api/server/lib/MultipartUploadHandler.spec.ts

@@ -0,0 +1,92 @@
+import { ReadableStream } from 'stream/web';
+
+import { expect } from 'chai';
+
+import { MultipartUploadHandler } from './MultipartUploadHandler';
+
+const createMockRequest = (
+	file: {
+		fieldname: string;
+		filename: string;
+		content: string;
+		mimetype?: string;
+	},
+	fields: Record<string, string> = {},
+): Request => {
+	const boundary = '----WebKitFormBoundary7MA4YWxkTrZu0gW';
+	const parts: string[] = [];
+
+	parts.push(
+		`--${boundary}`,
+		`Content-Disposition: form-data; name="${file.fieldname}"; filename="${file.filename}"`,
+		`Content-Type: ${file.mimetype || 'application/octet-stream'}`,
+		'',
+		file.content,
+	);
+
+	for (const [name, value] of Object.entries(fields)) {
+		parts.push(`--${boundary}`, `Content-Disposition: form-data; name="${name}"`, '', value);
+	}
+
+	parts.push(`--${boundary}--`);
+
+	const buffer = Buffer.from(parts.join('\r\n'));
+
+	const mockRequest: any = {
+		headers: {
+			entries: () => [['content-type', `multipart/form-data; boundary=${boundary}`]],
+		},
+		body: new ReadableStream({
+			async pull(controller) {
+				controller.enqueue(buffer);
+				controller.close();
+			},
+		}),
+	};
+
+	return mockRequest as Request;
+};
+
+describe('MultipartUploadHandler', () => {
+	describe('parseRequest', () => {
+		it('should decode %22 (double quotes) in filename as per the HTML5 multipart/form-data encoding algorithm', async () => {
+			const mockRequest = createMockRequest({
+				fieldname: 'file',
+				filename: 'This is %22test%22.jpg',
+				content: 'file content',
+				mimetype: 'image/jpeg',
+			});
+
+			const { file } = await MultipartUploadHandler.parseRequest(mockRequest, { field: 'file' });
+
+			expect(file?.filename).to.equal('This is "test".jpg');
+		});
+
+		it('should not decode other percent-encoded characters like %20 (space)', async () => {
+			const mockRequest = createMockRequest({
+				fieldname: 'file',
+				filename: 'test%20file.txt',
+				content: 'file content',
+				mimetype: 'text/plain',
+			});
+
+			const { file } = await MultipartUploadHandler.parseRequest(mockRequest, { field: 'file' });
+
+			// %20 is NOT encoded by the HTML5 spec; if it appears literally it should stay as-is
+			expect(file?.filename).to.equal('test%20file.txt');
+		});
+
+		it('should handle filename without any percent-encoded characters', async () => {
+			const mockRequest = createMockRequest({
+				fieldname: 'file',
+				filename: 'normal-file.txt',
+				content: 'file content',
+				mimetype: 'text/plain',
+			});
+
+			const { file } = await MultipartUploadHandler.parseRequest(mockRequest, { field: 'file' });
+
+			expect(file?.filename).to.equal('normal-file.txt');
+		});
+	});
+});

apps/meteor/app/api/server/lib/MultipartUploadHandler.ts

@@ -106,7 +106,10 @@ export class MultipartUploadHandler {
 		});
 
 		bb.on('file', (fieldname, file, info) => {
-			const { filename, mimeType } = info;
+			const { filename: rawFilename, mimeType } = info;
+			// The HTML5 multipart/form-data encoding algorithm percent-encodes `"` as `%22` in filenames.
+			// Busboy does not decode this for regular `filename=` parameters, so we reverse it here.
+			const filename = rawFilename.replace(/%22/gi, '"');
 
 			++filePendingCount;