Lukasz Lenart created WW-5840:
---------------------------------
Summary: Provide a path-stripped original file name for
action-based file uploads
Key: WW-5840
URL: https://issues.apache.org/jira/browse/WW-5840
Project: Struts 2
Issue Type: Improvement
Components: Core
Reporter: Lukasz Lenart
{{UploadedFile.getOriginalName()}} returns the file name exactly as the client
sent it in the multipart {{Content-Disposition}} header, including any
directory part ({{../}}, an absolute path, a backslash-separated path). The
framework itself never uses that value as a path: the file it stores is always
a generated {{upload_<uuid>.tmp}} inside the configured save directory, and
{{UploadedFile.getName()}} points to it.
The legacy {{FileUploadInterceptor}} passed actions the result of
{{MultiPartRequest.getFileNames()}}, which strips the directory part with
{{FilenameUtils.getName()}}. {{ActionFileUploadInterceptor}} and
{{UploadedFilesAware}}, the replacement API, pass {{getOriginalName()}}
unchanged, and neither the Javadoc example nor the documentation says that the
value is untrusted input. An application that builds a path from it, for
example {{new File(dir, uploadedFile.getOriginalName())}}, writes outside
{{dir}}.
Proposed change:
* add a basename-only accessor to {{UploadedFile}}, equivalent to
{{FilenameUtils.getName(getOriginalName())}}
* state in the Javadoc of {{getOriginalName()}} that it is client-supplied and
must not be used to build a filesystem path
* use the new accessor in the {{ActionFileUploadInterceptor}} Javadoc example
and the showcase upload actions
* add the same note to the Action File Upload pages on the website
Stripping the directory part is preferred to rejecting such names: rejection
broke legitimate file names when it was tried in WW-5501.
Reported by Junmin Zhu.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
