#33062: Null byte in uploaded filename extension is not cleaned up, results in
exception
-------------------------------+--------------------------------------
Reporter: Alex Vandiver | Owner: nobody
Type: Bug | Status: new
Component: Forms | Version: 3.2
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------------------------
Comment (by Alex Vandiver):
Oh, and for completeness, this is the traceback:
{{{
Traceback (most recent call last):
File "/usr/local/lib/python3.9/site-
packages/django/core/handlers/exception.py", line 47, in inner
response = get_response(request)
File "/usr/local/lib/python3.9/site-
packages/django/core/handlers/base.py", line 181, in _get_response
response = wrapped_callback(request, *callback_args,
**callback_kwargs)
File "/usr/local/lib/python3.9/site-
packages/django/views/decorators/csrf.py", line 54, in wrapped_view
return view_func(*args, **kwargs)
File "/Users/chmrr/src/test-django/upload_null_byte/uploads/views.py",
line 14, in index
form = UploadFileForm(request.POST, request.FILES)
File "/usr/local/lib/python3.9/site-
packages/django/core/handlers/wsgi.py", line 102, in _get_post
self._load_post_and_files()
File "/usr/local/lib/python3.9/site-packages/django/http/request.py",
line 362, in _load_post_and_files
self._post, self._files = self.parse_file_upload(self.META, data)
File "/usr/local/lib/python3.9/site-packages/django/http/request.py",
line 322, in parse_file_upload
return parser.parse()
File "/usr/local/lib/python3.9/site-
packages/django/http/multipartparser.py", line 233, in parse
handler.new_file(
File "/usr/local/lib/python3.9/site-
packages/django/core/files/uploadhandler.py", line 147, in new_file
self.file = TemporaryUploadedFile(self.file_name, self.content_type,
0, self.charset, self.content_type_extra)
File "/usr/local/lib/python3.9/site-
packages/django/core/files/uploadedfile.py", line 64, in __init__
file = tempfile.NamedTemporaryFile(suffix='.upload' + ext,
dir=settings.FILE_UPLOAD_TEMP_DIR)
File
"/usr/local/Cellar/[email protected]/3.9.5/Frameworks/Python.framework/Versions/3.9/lib/python3.9/tempfile.py",
line 541, in NamedTemporaryFile
(fd, name) = _mkstemp_inner(dir, prefix, suffix, flags, output_type)
File
"/usr/local/Cellar/[email protected]/3.9.5/Frameworks/Python.framework/Versions/3.9/lib/python3.9/tempfile.py",
line 251, in _mkstemp_inner
fd = _os.open(file, flags, 0o600)
ValueError: embedded null byte
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/33062#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/064.1933c0299dc3c32c30af056c5fd660e2%40djangoproject.com.
