[
https://issues.apache.org/jira/browse/FILEUPLOAD-235?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14624651#comment-14624651
]
Jochen Wiedmann commented on FILEUPLOAD-235:
--------------------------------------------
David,
it is not our intention to prevent users from shooting themselves in the foot.
We are following the Unix philosophy: Should you choose to do so, we do our
best to deliver Mr. Bullet into Mr. Foot as efiiciently, and quickly, as
possible.
Besides, I fail to see any security hazards. It is the Fileupload users
decision, where to store uploaded files, and how to name them, not ours.
Finally, this issue hasn't been a poblem for a real lots of Fileupload users
(you, being the exception). So, again: When weighing <our concerns against the
issue of a binary incompatibility, the latter problem clearly is of more
concern.
Sorry,
Jochen
> FileItem.getName() does not conform to the Java File.getName behaviour and
> *returns* a full path when provided with one
> -----------------------------------------------------------------------------------------------------------------------
>
> Key: FILEUPLOAD-235
> URL: https://issues.apache.org/jira/browse/FILEUPLOAD-235
> Project: Commons FileUpload
> Issue Type: Bug
> Affects Versions: 1.3
> Reporter: David
> Assignee: Jochen Wiedmann
> Priority: Minor
> Fix For: 2.x
>
>
> I understand that FileItem is simply following RFC 1867, but the
> implementation of 'getName'
> method on a file related class IMHO should follow the behaviour of the java
> File class which
> bq. Returns the name of the file or directory denoted by this abstract
> pathname. This is just the last name in the pathname's name sequence. If the
> pathname's name sequence is empty, then the empty string is returned.
> http://docs.oracle.com/javase/7/docs/api/java/io/File.html#getName()
> I propose that FileItem.getName() is changed to *match* the java File class
> behaviour and that another method called something like 'getRawName' be added
> to the FileItem class. The rational for this change is to make it less easy
> to shoot oneself in the foot (in no modern web application is a 'full
> filepath' useful, especially when most browsers do not send one!).
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
