Non UTF-8 binary data is corrupted when passed to File() parameter without file name

[DenisKuplyakov]

First Check

• I added a very descriptive title here.
• I used the GitHub search to find a similar question and didn't find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I already read and followed all the tutorial in the docs and didn't find an answer.
• I already checked if it is not related to FastAPI but to Pydantic.
• I already checked if it is not related to FastAPI but to Swagger UI.
• I already checked if it is not related to FastAPI but to ReDoc.

Commit to Help

• I commit to help with one of those options 👆

Example Code

from fastapi import FastAPI, File
from fastapi.testclient import TestClient
from typing_extensions import Annotated

app = FastAPI()


@app.post("/action")
def post_action(file: Annotated[bytes, File()]):
    return {"file_bytes": len(file)}


if __name__ == "__main__":
    client = TestClient(app)

    # With filename works as expected
    filename_body = b"""\
--Test\r\n\
Content-Type: application/octet-stream\r\n\
Content-Disposition: form-data; name="file"; filename="file"\r\n\
\r\n\
\xc3\x28\r\n\
--Test--\
"""
    with open("request_filename_body.bin", "wb") as f:
        f.write(filename_body)

    r = client.post(
        "/action",
        headers={"Content-Type": "multipart/form-data; boundary=Test"},
        content=filename_body,
    )
    assert r.status_code == 200, r.text
    # OK!
    assert r.json() == {"file_bytes": 2}, r.json()
    # OK!

    # Without filename the data got corrupted
    no_filename_body = b"""\
--Test\r\n\
Content-Type: application/octet-stream\r\n\
Content-Disposition: form-data; name="file"\r\n\
\r\n\
\xc3\x28\r\n\
--Test--\
"""
    with open("request_no_filename_body.bin", "wb") as f:
        f.write(no_filename_body)

    r = client.post(
        "/action",
        headers={"Content-Type": "multipart/form-data; boundary=Test"},
        content=no_filename_body,
    )
    assert r.status_code == 200, r.text
    # OK!
    assert r.json() == {"file_bytes": 2}, r.json()
    # AssertionError: {'file_bytes': 3}

Description

Non UTF-8 data got corrupted if passed to File() parameter without filename specified. Given code sends two bytes \xc3\x28, but, if no filename provided, length of the data in path operation equals to 3.

To reproduce by TestClient just run the provided code.

To reproduce by curl:

1. Run the provided code to save request bodies to files.
2. uvicorn test:app

$ curl http://localhost:8000/action -H "Content-Type: multipart/form-data; boundary=Test" --data-binary @request_filename_body.bin
{"file_bytes":2}

$ curl http://localhost:8000/action -H "Content-Type: multipart/form-data; boundary=Test" --data-binary @request_no_filename_body.bin
{"file_bytes":3}

Operating System

Linux

Operating System Details

No response

FastAPI Version

0.111.0

Pydantic Version

2.7.4

Python Version

3.8.10

Additional Context

Other packages versions that, I think, may affect:

python-multipart==0.0.9
uvicorn==0.30.1
httptools==0.6.1
uvloop==0.19.0

[jgould22]

See the Note box at the bottom of this page referencing rfc 7578

https://www.starlette.io/requests/#request-files

[DenisKuplyakov]

Thanks, looks like this one should be reported to starlette. I will do it later.

Regarding the current starlette behaviour. Just for the clarity of this discussion I copy-pasted the note from the link:

As settled in RFC-7578: 4.2, form-data content part that contains file assumed to have name and filename fields in Content-Disposition header: Content-Disposition: form-data; name="user"; filename="somefile". Though filename field is optional according to RFC-7578, it helps Starlette to differentiate which data should be treated as file. If filename field was supplied, UploadFile object will be created to access underlying file, otherwise form-data part will be parsed and available as a raw string.

RFC 7578 notes:

The file name isn't mandatory
for cases where the file name isn't available or is meaningless or
private; this might result, for example, when selection or drag-and-
drop is used or when the form data content is streamed directly from
a device.

So absence of filename must be expected by the web server. Current design that corrupts a data silently should be considered broken, IMHO.

[estebanx64]

Hi @jgould22 as @DenisKuplyakov has mentioned, the docs from starlette says you should add a filename to be able to identify there is a file in the request, despite the RFC says isn't mandatory, the starlette docs explain the expected behavior.

If you still feel disagree with it, feel free to open a feature request in startlette repo about this stuff.