Summary

We have found a regression with latest releases of Twisted in twisted.web.http due to replacement of cgi.parse_multipart in commit 4579398 which has resulted in our web server only being able to retrieve a single file from a request that contained multiple files.

Environment

• Twisted version 24.x

Description

The web app has a file picker form where a user can select multiple files to upload to the web server. Here is a sample snippet of request received by web server:

Content-Disposition: form-data; name="file"; filename="test1.torrent"
Content-Type: application/x-bittorrent
...
Content-Disposition: form-data; name="file"; filename="tes2.torrent"
Content-Type: application/x-bittorrent

The web server parses out the filenames as follows:

files = request.args.get(b'file', [])

Expected

A list containing both files

Actual

A list containing only the first file

Investigation notes

The content-disposition of the file upload form is using the same name parameter for both files. However the commit to replace cgi results in only a single file ever being assigned to a name:

        result[name.encode("utf8")] = [payload]

According to rfc7578 this is correct request

To match widely deployed implementations, multiple files MUST be sent
by supplying each file in a separate part but all with the same
"name" parameter.

The solution to the problem is to assign result to a defaultdict(list) then for the same key append payloads found to the list. I'll push a PR shortly...