Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

This project is archived and is in readonly mode.

method original_filename in UploadFile module is broken

#731

While persnickety, there is a flaw in the setter for original filename, in Rails 2.1.0, in an apache/passenger setup.

The filename on the next line:

&;()<>|!{}[]'"*?~\$`.ext

for example, comes out as

&;()<>|!{}[]'

Note that the leading space, and everything trailing the single-quote (at the double-quote position) is truncated.

We recently migrated from Mongrel, where we had hand-rolled our own upload filename grabber, to Passenger, and wanted to use the nice mod_upload_progress that exists out there. The code we used was /BAD/, but looked like this:

temp = e.split('=')

if temp[0] == "filename"

  1. remove begin/end double-quotes, without
  2. munging double-quotes in the filename

filename = temp[1].chomp().chop().reverse().chop().reverse()

puts "filename: #{filename}" if @debug

end

This preserved the filename perfectly -- we also later massaged out the IE full-path to get just the basename.

So, while filename that has all those characters is unlikely, it's indeed a valid filename, and should be preserved.

Reported by Armando Di Cianno · July 30th, 2008 @ 11:48 PM

State: stale
Milestone: 2.x
Assigned to: nobody
Importance: none

Activity

  1. Armando Di Cianno
    Armando Di Cianno

    I've narrowed down the problem to line 596 in read_multipart in request.rb (same file as above method).

    head =~ /Content-Disposition:.* filename=(?:"((?:\\.|[^\"]))"|([^;]))/ni

    So, given

    str = "Content-Disposition: filename=\" &;()<>|!{}[]'\"*?~\\$`.mpg\""

    then

    str =~ /Content-Disposition:.* filename=(?:"((?:\\.|[^\"]))"|([^;]))/ni

    we get

    >> $1

    => " &;()<>|!{}[]'"

    >> $2

    => nil

    July 31st, 2008 @ 09:04 PM

  2. josh
    josh
    • State changed from new to stale

    Staling out, please let me know if its still an issue.

    November 22nd, 2008 @ 07:52 PM