Issue Review: cloudflare/workers-sdk#3520

Summary

Cannot PUT R2 objects with keys containing .. (consecutive dots) - Cloudflare firewall blocks the request.

Findings

• Created: 2023-06-25
• Updated: 2025-10-30
• Version: wrangler 3.1.1 → 4.61.0
• Component: r2, wrangler
• Labels: bug, internal, r2
• Comments: 6

Key Evidence

• User can upload files with .. in key via R2 dashboard but not via wrangler CLI
• Maintainer @petebacondarwin identified root cause: Cloudflare firewall blocks URLs containing .. in path
• This is a security measure (path traversal protection) at the API level
• encodeURIComponent("a...b") returns a...b - encoding doesn't help
• Visiting the API URL directly shows firewall block
• Same file uploads fine when .. removed from key name
• Related issue with keys containing / (forward slash) - different error (ENOENT)

Recommendation

Status: KEEP OPEN

Reasoning: Valid bug where wrangler CLI cannot upload R2 objects that are uploadable via the dashboard. The root cause is the Cloudflare firewall blocking .. in URL paths. This is labeled internal because it requires API/platform changes to support encoded object keys or alternative upload methods.

Action: Requires Cloudflare API team to either whitelist R2 object key paths from the .. firewall rule, or implement an alternative upload mechanism (e.g., query parameter for object key, or multipart form upload).

Suggested Comment

N/A - Root cause identified and labeled internal; requires platform team action.