uploading release asset renames files

[charles-cooper]

the release asset upload API modifies characters in uploaded filenames (https://docs.github.com/en/rest/releases/assets?apiVersion=2022-11-28#upload-a-release-asset)

however, when uploading release assets through the webapp, special characters including '+' are preserved. it seems that the webapp uses a different API.

not sure if this is the place to report this, but the API should not be modifying filenames.

[pfreixes]

Thanks for reporting this @shiftkey

From my understanding the encoding discussion matters, reason is because when the API is used, for example using CURL the special characters like + are interpreted as spaces, so they are encoded automatically with %20. Behind the scenes same logic is used - regardless if the API or the web is used - and the %20 is converted as a .. (the upload API calls the same endpoint as the web browser for creating a new policy and getting the final name for a release asset)

If in the other hand the allowed + is used this will not be converted, but when this character is used as part of an URL parameter this needs to be converted to its escaped character which is %2B.

When using the web form, names are not passed as URL parameter but as multi form upload parameters which do not suffer same issues as the former ones.

So from my understanding both interfaces are behaving equally, but the input from the user when using the API needs to be sanitised for avoiding using characters like + which is meant to be an space.

[charles-cooper]

In that case, the API docs should be updated to indicate that special characters in filenames should be URL-encoded!

[shiftkey]

@charles-cooper we can arrange for that - thanks for the heads up!

[pfreixes]

Let us know if you need anything else from our side

[charles-cooper]

Let us know if you need anything else from our side

Now that you mention it -- I would also update the example in the docs to a curl command which works with filenames that even have special characters. I think the new --url-query (as of curl 7.87) CLI option would do the job here, but I have not checked.