commons-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jochen Wiedmann (JIRA)" <j...@apache.org>
Subject [jira] Resolved: (FILEUPLOAD-122) Filename may contain a full path
Date Thu, 14 Dec 2006 21:04:23 GMT
     [ http://issues.apache.org/jira/browse/FILEUPLOAD-122?page=all ]

Jochen Wiedmann resolved FILEUPLOAD-122.
----------------------------------------

    Resolution: Invalid

I was initially thinking that the request made some sense, but after reading the various comments
in this bug as well as FILEUPLOAD-17 (or FILEUPLOAD-68 for that matter), I do wholeheartly
agree with the current behaviour to leave the filename as it is sent by the browser. If the
user actually wants to remove preceding path components then he can do so quite easily. The
converse wouldn't be true, if we'd attempt to "sanitize" the name.

As this topic has been discussed now in at least three cases and all developers agree on it,
I am closing the bug.


> Filename may contain a full path
> --------------------------------
>
>                 Key: FILEUPLOAD-122
>                 URL: http://issues.apache.org/jira/browse/FILEUPLOAD-122
>             Project: Commons FileUpload
>          Issue Type: Bug
>    Affects Versions: 1.1.1
>            Reporter: Sebastian Beigel
>            Priority: Blocker
>
> The filename extracted from the content disposition may contain a full path (i.e. as
submitted by the Internet Explorer for example).
> It's is important to check for this and strip the path information accordingly as the
upload fails if you use FileItem#getName() to build your destination path.
> I patched the abstract class FileUploadBase#getFileName(...) with a few lines of code
inspired by COS' MultiPartParser :)
> Starting on line 447 (after fileName = fileName.trim(); )
>                         // The filename may contain a full path.  Cut to just the filename.
>                         int slash = Math.max(fileName.lastIndexOf('/'), fileName.lastIndexOf('\\'));
// check for Unix AND Win separator
>                         if (slash > -1) {
>                           fileName = fileName.substring(slash + 1);  // past last slash
>                         }

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira

        

---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org


Mime
View raw message