homepage

I have just discovered the same problem with get_filename.
Not surprising as its code is basically the same as get_boundary.
Unix paths can contain anything, so it's not correct to remove special characters. [It's up to the receiving file system to decide how to deal with chars that are not valid for it; the original name must be passed unchanged]
If the quoting/unquoting is fixed for filenames, then it should be OK for the boundary as well.
I think collapse_rfc2231_value should assume that any unquoting has already been done, and should therefore not call utils.unquote at all.
The get_param() method by default unquotes both single strings and encoded triplets, so it's certainly the case that get_boundary and get_filename will pass an unquoted value to rfc2231, as will any other caller that calls get_param with the default parameters.