Generated multipart curl doesn't escape characters of form data fields

[filfreire]

Related with Kong/insomnia#3868

As of now we are not escaping double-quote characters that are in data fields of curl requests. This causes the curl request to fail.

Example generated curl:

curl --request GET \
  --url http://mockbin.org/request/anything \
  --header 'content-type: multipart/form-data; boundary=---011000010111000001101001' \
  --form timestamp=2022-05-10T10:04:18.748Z \
  --form field=test \
  --form 'data=<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<test>TEST<test>'

This doesn't seem to be the case for example for Python, where we escape characters we need to, and the request works fine:

import requests

url = "http://mockbin.org/request/anything"

payload = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"timestamp\"\r\n\r\n2022-05-10T10:07:25.650Z\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"field\"\r\n\r\ntest\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"data\"\r\n\r\n<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<test>TEST<test>\r\n-----011000010111000001101001--\r\n"
headers = {'content-type': 'multipart/form-data; boundary=---011000010111000001101001'}

response = requests.request("GET", url, data=payload, headers=headers)

print(response.text)

Example postman generated curl:

curl --location --request POST 'https://test.com' \
--form 'timestamp="2021-07-14T01:02:34.567Z"' \
--form 'field="test"' \
--form 'data="<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>
<test>TEST<test>"'

[filfreire]

Another issue we might have, similar to this one, we don't include the content type for each form part.

Example from Kong/insomnia#4334

What httpsnippet exports:

curl --request POST \
  --url http://localhost:8080/upload-file \
  --header 'Content-Type: multipart/form-data; boundary=---011000010111000001101001' \
  --form 'metadata={
	"description": "Some description for my file"
}' \
  --form file=@/Users/user/Documents/file.md

What postman exports:

curl --location --request POST 'localhost:8080/upload-file' \
--form 'metadata="{
  \"description\": \"Some description for my file\"
}";type=application/json' \
--form 'file=@"/Users/filipe.freire@konghq.com/Documents/a.diff"'

We are missing the ;type=application/json chunk.

[gaggle]

To bump this, I confirm Bruno generates cURL commands with multiple --data flags that fail when form data contains special characters. That is:

When exporting requests as cURL commands, Bruno generates multiple --data flags for form-urlencoded data. This causes failures when field values contain special characters that need URL encoding.

Example of Bruno's generated cURL

curl --request POST \
  --url https://example.com/api/token \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data 'username=myuser' \
  --data 'password=p@ss&word'

Problem:
• Multiple --data flags don't URL-encode their values
• Special characters like &, =, %, +, etc. in passwords or other fields break the request
• The request fails silently or sends malformed data

Expected behavior

Bruno should either:

1. Use a single --data flag with properly encoded values: --data 'username=myuser&password=p%40ss%26word'
2. Use --data-urlencode for each field: --data-urlencode 'username=myuser' --data-urlencode 'password=p@ss&word'

Environment:

• Bruno version: Bruno 2.13.2
• curl version: 8.7.1
• OS: macOS