https://bz.apache.org/bugzilla/show_bug.cgi?id=70143
Bug ID: 70143
Summary: InvalidFileNameException thrown when only
IllegalStateException is expected when uploading file
Product: Tomcat 10
Version: 10.1.57
Hardware: PC
OS: Linux
Status: NEW
Severity: minor
Priority: P2
Component: Catalina
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ------
During tests we observed that when application calls getParameterMap we receive
InvalidFileNameException, but javadoc states that
IllegalStateException should be thrown.
Please make sure that only IllegalStateException is thrown
Stacktrace is:
Invalid file name: "'"\0<scrIpt>alert(1)
org.apache.tomcat.util.http.fileupload.InvalidFileNameException: Invalid file
name: "'"\0<scrIpt>alert(1)
at
org.apache.tomcat.util.http.fileupload.util.Streams.checkFileName(Streams.java:61)
at
org.apache.tomcat.util.http.fileupload.impl.FileItemStreamImpl.getName(FileItemStreamImpl.java:160)
at
org.apache.tomcat.util.http.fileupload.FileUploadBase.parseRequest(FileUploadBase.java:463)
at org.apache.catalina.connector.Request.parseParts(Request.java:2576)
at
org.apache.catalina.connector.Request.doParseParameters(Request.java:2927)
at
org.apache.catalina.connector.Request.parseParameters(Request.java:2864)
at
org.apache.catalina.connector.Request.getParameterNames(Request.java:1122)
at
org.apache.catalina.connector.Request.getParameterMap(Request.java:1107)
at
org.apache.catalina.connector.RequestFacade.getParameterMap(RequestFacade.java:170)
at
jakarta.servlet.ServletRequestWrapper.getParameterMap(ServletRequestWrapper.java:168)
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
