fix: Uploaded files with quoted names appear as %22 in chat

[Copilot]

The HTML5 multipart/form-data spec requires browsers to percent-encode " as %22 in filename= Content-Disposition parameters. Busboy only decodes extended filename*= parameters (RFC 5987), leaving %22 literal — so a file named This is "test" was stored in the DB and displayed in chat as This is %22test%22.

Changes

• MultipartUploadHandler.ts: Decode %22 back to " on the raw filename from busboy before it propagates to storage and message attachments. Applies to all upload paths (/v1/rooms.media and /v1/livechat/upload).

const filename = rawFilename.replace(/%22/gi, '"');

Other percent sequences (e.g. %20) are intentionally left untouched to avoid misinterpreting literal % characters in filenames.

• MultipartUploadHandler.spec.ts: Unit tests covering %22 decoding and confirming that %20 is not decoded.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Uploaded Items With Quoted Names Appear as HTML Escapes in Chat</issue_title>
<issue_description>### Description:

If you upload an attachment in direct message or in a channel and you use quotes, those quotes aren't represented properly in the various chat clients.

Steps to reproduce:

1. Upload an image or video
2. Name it This is "test"
3. In the channel it will appear as This is a %22test%22

Expected behavior:

It should appear as This is a "test"

Actual behavior:

Server Setup Information:

• Version of Rocket.Chat Server: 3.4.1
• Operating System: Linux
• Deployment Method: docker
• Number of Running Instances: 1
• DB Replicaset Oplog: Enabled
• NodeJS Version: v12.16.1
• MongoDB Version: 4.2.8

Client Setup Information

• Desktop App or Browser Version: Any
• Operating System: Any

Additional context

This may be related to the following issues:
#17797
#17688

I haven't exhaustively tested other characters that might be escaped in this manner so there may be more.

Relevant logs:

(Logs not required)
</issue_description>

Comments on the Issue (you are @copilot in this section)

@MartinSchoeler Seems to be working on the latest develop version

If you are still facing this issue in the newer versions, please reopen this. Thanks!</comment_new>
<comment_new>@MartinSchoeler
The bug seems to have appeared again indeed.</comment_new>

• Fixes Uploaded Items With Quoted Names Appear as HTML Escapes in Chat #18193

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[dionisio-bot]

Looks like this PR is not ready to merge, because of the following issues:

• This PR is missing the 'stat: QA assured' label

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2c8d382

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[KevLehman]

@copilot do we need to decode line breaks and carret returns for file names? What would be the advantage of doing?

[ggazzo]

@copilot do we need to decode line breaks and carret returns for file names? What would be the advantage of doing?

[Copilot]

No advantage — removed the line break decoding in 2c8d382. Decoding %0D/%0A in filenames would only introduce risk (e.g. log injection) with no real-world benefit, since no user would name a file with literal newlines. The fix now only decodes %22 → ", which is the actual issue reported.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.64%. Comparing base (55bf071) to head (2c8d382).
⚠️ Report is 63 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop   #39000   +/-   ##
========================================
  Coverage    70.64%   70.64%           
========================================
  Files         3189     3189           
  Lines       112716   112716           
  Branches     20413    20413           
========================================
  Hits         79632    79632           
  Misses       31040    31040           
  Partials      2044     2044           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[KevLehman]

@ggazzo ask copilot to mock the imports on the unit tests, an import it's trying to use meteor/meteor.