Mailing-List: contact issues-help@commons.apache.org; run by ezmlm
Precedence: bulk
Reply-To: issues@commons.apache.org
Date: Fri, 10 Jul 2015 08:22:04 +0000 (UTC)
From: "David (JIRA)" <jira@apache.org>
To: issues@commons.apache.org
Message-ID: <JIRA.12657191.1373509675000.152265.1436516524693@Atlassian.JIRA>
In-Reply-To: <JIRA.12657191.1373509675000@Atlassian.JIRA>
References: <JIRA.12657191.1373509675000@Atlassian.JIRA>
 <JIRA.12657191.1373509675994@arcas>
Subject: [jira] [Commented] (FILEUPLOAD-235) FileItem.getName() does not
 conform to the Java File.getName behaviour and *returns* a full path when
 provided with one
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/FILEUPLOAD-235?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14621972#comment-14621972 ] 

David commented on FILEUPLOAD-235:
----------------------------------

[~jochen@apache.org] that's why I was asking to make this change in the next major version release. As per the issue description:
{quote}
The rational for this change is to make it less easy to shoot oneself in the foot (in no modern web application is a 'full filepath' useful, especially when most browsers do not send one!).
{quote}
Also, afaik internet explorer is the only browser to send the 'full filepath' for a file upload.

If you wish to keep a potential security hazard in the code so be it.

> FileItem.getName() does not conform to the Java File.getName behaviour and *returns* a full path when provided with one
> -----------------------------------------------------------------------------------------------------------------------
>
>                 Key: FILEUPLOAD-235
>                 URL: https://issues.apache.org/jira/browse/FILEUPLOAD-235
>             Project: Commons FileUpload
>          Issue Type: Bug
>    Affects Versions: 1.3
>            Reporter: David
>            Assignee: Jochen Wiedmann
>            Priority: Minor
>             Fix For: 2.x
>
>
> I understand that FileItem is simply following RFC 1867, but the implementation of 'getName' 
> method on a file related class IMHO should follow the behaviour of the java File class which
> bq. Returns the name of the file or directory denoted by this abstract pathname. This is just the last name in the pathname's name sequence. If the pathname's name sequence is empty, then the empty string is returned. http://docs.oracle.com/javase/7/docs/api/java/io/File.html#getName()
> I propose that FileItem.getName() is changed to *match* the java File class behaviour and that another method called something like 'getRawName' be added to the FileItem class. The rational for this change is to make it less easy to shoot oneself in the foot (in no modern web application is a 'full filepath' useful, especially when most browsers do not send one!).


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)