[chaliy]

Motivation

• Prevent header-injection / quoted-string breakout when user-controlled multipart field names or filenames contain backslashes before quotes, which the previous sanitizer left unescaped.

Description

• Change sanitize_multipart_name in crates/bashkit/src/builtins/curl.rs to escape both backslashes (\) and double quotes (") when building HTTP quoted-string parameters.
• Ensure the sanitized output is used in Content-Disposition headers for both file and text multipart parts (same function is used at emission sites).
• Add a regression unit test test_sanitize_multipart_name_escapes_backslash_before_quote in crates/bashkit/src/builtins/curl.rs that verifies a backslash-before-quote value is escaped correctly.

Testing

• Ran cargo fmt --check which passed.
• Ran the targeted unit test via cargo test -p bashkit test_sanitize_multipart_name_escapes_backslash_before_quote which passed.
• Ran cargo test -p bashkit --features http_client sanitize_multipart_name and cargo test -p bashkit and observed all tests pass.
• Note: this checkout had no configured upstream remote so a rebase onto origin/main could not be performed from this environment.

---

Codex Task

[Copilot]

Pull request overview

This PR hardens the curl builtin’s multipart Content-Disposition header construction by correctly escaping HTTP quoted-string metacharacters, preventing parameter breakout when user-controlled multipart field names or filenames contain backslashes before quotes.

Changes:

• Update sanitize_multipart_name to escape both \ and " (while still rejecting CR/LF) to prevent quoted-string termination/injection.
• Add a regression unit test covering the \" edge case to ensure backslash-before-quote is handled safely.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	c462bdb	Commit Preview URL	Jun 05 2026, 08:12 PM