fix: encode filenames

packages/api/src/car.js

@@ -149,7 +149,8 @@ export async function handleCarUpload (request, env, ctx, car, uploadType = 'Car
     backup(car, rootCid, user._id, env)
   ])
 
-  let name = headers.get('x-name')
+  const xName = headers.get('x-name')
+  let name = xName && decodeURIComponent(xName)
   if (!name || typeof name !== 'string') {
     name = `Upload at ${new Date().toISOString()}`
   }
@@ -211,7 +212,7 @@ export async function handleCarUpload (request, env, ctx, car, uploadType = 'Car
     tasks.forEach(t => ctx.waitUntil(t()))
   }
 
-  return new JSONResponse({ cid })
+  return new JSONResponse({ cid, name })
 }
 
 export async function carPut (request, env, ctx) {

packages/api/src/upload.js

@@ -15,11 +15,6 @@ export async function uploadPost (request, env, ctx) {
   const { headers } = request
   const contentType = headers.get('content-type') || ''
 
-  let name = headers.get('x-name')
-  if (!name || typeof name !== 'string') {
-    name = `Upload at ${new Date().toISOString()}`
-  }
-
   let input
   if (contentType.includes('multipart/form-data')) {
     const form = await toFormData(request)

packages/api/test/upload.spec.js

@@ -65,4 +65,26 @@ describe('POST /upload', () => {
     assert(cid, 'Server response payload has `cid` property')
     assert.strictEqual(cid, expectedCid, 'Server responded with expected CID')
   })
+
+  it('should decode filename from header', async () => {
+    const expectedName = 'filename–with–funky–chars'
+
+    // Create token
+    const token = await getTestJWT()
+
+    const res = await fetch(new URL('upload', endpoint), {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'X-Name': encodeURIComponent(expectedName)
+      },
+      body: new Blob(['hello world!'])
+    })
+
+    assert(res, 'Server responded')
+    assert(res.ok, 'Server response ok')
+    const { name } = await res.json()
+    assert(name, 'Server response payload has `name` property')
+    assert.strictEqual(name, expectedName, 'Server responded with expected decoded name')
+  })
 })

packages/client/src/lib.js

@@ -137,7 +137,7 @@ class Web3Storage {
     let headers = Web3Storage.headers(token)
 
     if (name) {
-      headers = { ...headers, 'X-Name': name }
+      headers = { ...headers, 'X-Name': encodeURIComponent(name) }
     }
 
     const roots = await car.getRoots()

packages/client/test/put.spec.js

@@ -165,6 +165,19 @@ describe('putCar', () => {
     })
     assert.equal(cid, block.cid.toString(), 'returned cid matches the CAR')
   })
+
+  it('encodes filename for header', async () => {
+    const client = new Web3Storage({ token, endpoint })
+    const carReader = await createCar('hello world')
+    const expectedCid = 'bafybeiczsscdsbs7ffqz55asqdf3smv6klcw3gofszvwlyarci47bgf354'
+    const cid = await client.putCar(carReader, {
+      name: 'filename–with–funky–chars',
+      onRootCidReady: cid => {
+        assert.equal(cid, expectedCid, 'returned cid matches the CAR')
+      }
+    })
+    assert.equal(cid, expectedCid, 'returned cid matches the CAR')
+  })
 })
 
 function prepareFiles () {

packages/website/lib/api.js

@@ -1,6 +1,8 @@
 import { getMagic } from './magic'
 import constants from './constants'
 
+/** @typedef {{ name?: string } & import('web3.storage').Upload} Upload */
+
 export const API = constants.API
 
 const LIFESPAN = constants.MAGIC_TOKEN_LIFESPAN / 1000