[
https://issues.apache.org/jira/browse/FILEUPLOAD-235?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14621972#comment-14621972
]
David edited comment on FILEUPLOAD-235 at 7/13/15 12:31 AM:
------------------------------------------------------------
[[email protected]] that's why I was asking to make this change in the next
major version release. As per the issue description:
{quote}
The rational for this change is to make it less easy to shoot oneself in the
foot (in no modern web application is a 'full filepath' useful, especially when
most browsers do not send one!).
{quote}
Also, afaik internet explorer is the only browser to send the (rea 'full
filepath' for a file upload and since IE8 it does not always send the 'real'
'full filepath' information, see
http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-protection.aspx
for details.
If you wish to keep a potential security hazard in the code so be it.
was (Author: dblack):
[[email protected]] that's why I was asking to make this change in the next
major version release. As per the issue description:
{quote}
The rational for this change is to make it less easy to shoot oneself in the
foot (in no modern web application is a 'full filepath' useful, especially when
most browsers do not send one!).
{quote}
Also, afaik internet explorer is the only browser to send the 'full filepath'
for a file upload and since IE8 it does not always send the 'full filepath'
information, see
http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-protection.aspx
for details.
If you wish to keep a potential security hazard in the code so be it.
> FileItem.getName() does not conform to the Java File.getName behaviour and
> *returns* a full path when provided with one
> -----------------------------------------------------------------------------------------------------------------------
>
> Key: FILEUPLOAD-235
> URL: https://issues.apache.org/jira/browse/FILEUPLOAD-235
> Project: Commons FileUpload
> Issue Type: Bug
> Affects Versions: 1.3
> Reporter: David
> Assignee: Jochen Wiedmann
> Priority: Minor
> Fix For: 2.x
>
>
> I understand that FileItem is simply following RFC 1867, but the
> implementation of 'getName'
> method on a file related class IMHO should follow the behaviour of the java
> File class which
> bq. Returns the name of the file or directory denoted by this abstract
> pathname. This is just the last name in the pathname's name sequence. If the
> pathname's name sequence is empty, then the empty string is returned.
> http://docs.oracle.com/javase/7/docs/api/java/io/File.html#getName()
> I propose that FileItem.getName() is changed to *match* the java File class
> behaviour and that another method called something like 'getRawName' be added
> to the FileItem class. The rational for this change is to make it less easy
> to shoot oneself in the foot (in no modern web application is a 'full
> filepath' useful, especially when most browsers do not send one!).
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
