#26325: File upload crashes when presented with filename ending with a backslash
--------------------------------------+--------------------
Reporter: jmb202 | Owner: nobody
Type: Uncategorized | Status: new
Component: File uploads/storage | Version: 1.8
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 1
Easy pickings: 0 | UI/UX: 0
--------------------------------------+--------------------
The multipart parser in Django 1.8.10 will crash if the following
conditions are met:
* the total POST body is small enough to cause the
MemoryFileUploadHandler to be active
* the name of the file provided in the multipart header ends with a
backslash
The following traceback is obtained:
{{{
Traceback (most recent call last):
File "/usr/lib/python2.7/dist-packages/django/core/handlers/base.py",
line 125, in get_response
File "/usr/lib/python2.7/dist-packages/django/middleware/csrf.py", line
170, in process_view
request_csrf_token = request.POST.get('csrfmiddlewaretoken', '')
File "/usr/lib/python2.7/dist-packages/django/core/handlers/wsgi.py",
line 146, in _get_post
self._load_post_and_files()
File "/usr/lib/python2.7/dist-packages/django/http/request.py", line
215, in _load_post_and_files
self._post, self._files = self.parse_file_upload(self.META, data)
File "/usr/lib/python2.7/dist-packages/django/http/request.py", line
180, in parse_file_upload
return parser.parse()
File "/usr/lib/python2.7/dist-packages/django/http/multipartparser.py",
line 145, in parse
self.handle_file_complete(old_field_name, counters)
File "/usr/lib/python2.7/dist-packages/django/http/multipartparser.py",
line 255, in handle_file_complete
file_obj = handler.file_complete(counters[i])
File "/usr/lib/python2.7/dist-
packages/django/core/files/uploadhandler.py", line 141, in file_complete
self.file.seek(0)
AttributeError: 'TemporaryFileUploadHandler' object has no attribute
'file'
}}}
I have attached a patch containing a proposed fix and regression test.
--
Ticket URL: <https://code.djangoproject.com/ticket/26325>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/049.1b5aafbca6740f6d8afe57bcc602044d%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
