This project is archived and is in readonly mode.

#731 ✓stale
Armando Di Cianno

method original_filename in UploadFile module is broken

Reported by Armando Di Cianno | July 30th, 2008 @ 11:48 PM | in 2.x

While persnickety, there is a flaw in the setter for original filename, in Rails 2.1.0, in an apache/passenger setup.

The filename on the next line:


for example, comes out as


Note that the leading space, and everything trailing the single-quote (at the double-quote position) is truncated.

We recently migrated from Mongrel, where we had hand-rolled our own upload filename grabber, to Passenger, and wanted to use the nice mod_upload_progress that exists out there. The code we used was /BAD/, but looked like this:

temp = e.split('=')

if temp[0] == "filename"

  1. remove begin/end double-quotes, without
  2. munging double-quotes in the filename

filename = temp[1].chomp().chop().reverse().chop().reverse()

puts "filename: #{filename}" if @debug


This preserved the filename perfectly -- we also later massaged out the IE full-path to get just the basename.

So, while filename that has all those characters is unlikely, it's indeed a valid filename, and should be preserved.

Comments and changes to this ticket

  • Armando Di Cianno

    Armando Di Cianno July 31st, 2008 @ 09:04 PM

    I've narrowed down the problem to line 596 in read_multipart in request.rb (same file as above method).

    head =~ /Content-Disposition:.* filename=(?:"((?:\\.|[^\"]))"|([^;]))/ni

    So, given

    str = "Content-Disposition: filename=\" &;()<>|!{}[]'\"*?~\\$`.mpg\""


    str =~ /Content-Disposition:.* filename=(?:"((?:\\.|[^\"]))"|([^;]))/ni

    we get

    >> $1

    => " &;()<>|!{}[]'"

    >> $2

    => nil

  • josh

    josh November 22nd, 2008 @ 07:52 PM

    • State changed from “new” to “stale”

    Staling out, please let me know if its still an issue.

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile »

<h2 style="font-size: 14px">Tickets have moved to Github</h2>

The new ticket tracker is available at <a href=""></a>