dxbjavid commented on PR #3572: URL: https://github.com/apache/cxf/pull/3572#issuecomment-6161765118
all four addressed. safeFileName now replaces NUL and ':' with '_' rather than returning null, so a valid name like Meeting 10:30.pdf keeps a usable form; only ".", ".." and a name that strips down to nothing are still dropped. the file-vs-field decision in EntityPartUtils and EntityPartProvider is back on the raw cd.getFilename() != null, with safeFileName applied only to the name itself, so filename="reports/" or ".." stays a file part instead of turning into a form field. added a small EntityPart test in rt/frontend/jaxrs covering the traversal, plain and trailing-separator cases, and put a javadoc note on getFilename() flagging the value as untrusted and pointing at FileUtils.safeFileName. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
