Added Filepath.getSanitizedFilename, deprecated getFilename

core/play/src/main/java/play/mvc/Http.java

@@ -15,6 +15,9 @@
 import java.net.URLEncoder;
 import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.InvalidPathException;
+import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.security.cert.X509Certificate;
 import java.time.Duration;
 import java.util.*;
@@ -1499,7 +1502,33 @@ public String getKey() {
         return key;
       }
 
-      /** @return the file name */
+      /**
+       * @return the sanitized version of the file name (i.e. only the filename, no path components)
+       */
+      public String getSanitizedFilename() {
+        try {
+          // Will throw InvalidPathException on invalid filepaths
+          Path name = Paths.get(filename).normalize().getFileName();
+
+          // This can occur if the filepath is empty when fully resolved
+          if (name == null || name.toString().isEmpty() || name.toString().equals("..")) {
+            throw new InvalidPathException(filename, "");
+          }
+          return name.toString();
+
+        } catch (InvalidPathException e) {
+          throw new RuntimeException(
+              "Unable to sanitize the filename given to MultipartFormData.FilePart: \""
+                  + e.getInput()
+                  + "\"");
+        }
+      }
+
+      /**
+       * @deprecated Use {@link #getSanitizedFilename()} instead.
+       * @return the raw file name
+       */
+      @Deprecated
       public String getFilename() {
         return filename;
       }

core/play/src/test/java/play/mvc/SanitizedFilenameTest.java

@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) from 2022 The Play Framework Contributors <https://github.com/playframework>, 2011-2021 Lightbend Inc. <https://www.lightbend.com>
+ */
+
+package play.mvc;
+
+import static org.junit.Assert.assertEquals;
+
+import org.junit.Test;
+import play.mvc.Http.MultipartFormData;
+
+public class SanitizedFilenameTest {
+  @Test
+  public void sanitizeSingleComponent() {
+    MultipartFormData.FilePart<Object> p =
+        new MultipartFormData.FilePart<Object>(null, "abc", null, null);
+    assertEquals("abc", p.getSanitizedFilename());
+  }
+
+  @Test
+  public void sanitizeMultipleComponents() {
+    MultipartFormData.FilePart<Object> p =
+        new MultipartFormData.FilePart<Object>(null, "abc/def/xyz", null, null);
+    assertEquals("xyz", p.getSanitizedFilename());
+  }
+
+  @Test
+  public void sanitizeWithTrailingDots() {
+    MultipartFormData.FilePart<Object> p =
+        new MultipartFormData.FilePart<Object>(null, "a/b/c/././", null, null);
+    assertEquals("c", p.getSanitizedFilename());
+  }
+
+  @Test
+  public void sanitizeWithLeadingDoubleDots() {
+    MultipartFormData.FilePart<Object> p =
+        new MultipartFormData.FilePart<Object>(null, "../../../a", null, null);
+    assertEquals("a", p.getSanitizedFilename());
+  }
+
+  @Test
+  public void sanitizeWithNameAfterDoubleDots() {
+    MultipartFormData.FilePart<Object> p =
+        new MultipartFormData.FilePart<Object>(null, "../../../a/../b", null, null);
+    assertEquals("b", p.getSanitizedFilename());
+  }
+
+  @Test
+  public void sanitizeWithTrailingDoubleDots() {
+    MultipartFormData.FilePart<Object> p =
+        new MultipartFormData.FilePart<Object>(null, "a/b/c/../..", null, null);
+    assertEquals("a", p.getSanitizedFilename());
+  }
+
+  @Test
+  public void sanitizeWithRedundantSlashesAndDots() {
+    MultipartFormData.FilePart<Object> p =
+        new MultipartFormData.FilePart<Object>(null, "///a//b/c/.././d/././/", null, null);
+    assertEquals("d", p.getSanitizedFilename());
+  }
+
+  @Test(expected = RuntimeException.class)
+  public void sanitizeThrowsOnEmptyPath() {
+    (new MultipartFormData.FilePart<Object>(null, "", null, null)).getSanitizedFilename();
+  }
+
+  @Test(expected = RuntimeException.class)
+  public void sanitizeThrowsOnCurrentDirectory() {
+    (new MultipartFormData.FilePart<Object>(null, ".", null, null)).getSanitizedFilename();
+  }
+
+  @Test(expected = RuntimeException.class)
+  public void sanitizeThrowsOnDoubleDots() {
+    (new MultipartFormData.FilePart<Object>(null, "..", null, null)).getSanitizedFilename();
+  }
+
+  @Test(expected = RuntimeException.class)
+  public void sanitizeThrowsPastRoot() {
+    (new MultipartFormData.FilePart<Object>(null, "a/b/../../..", null, null))
+        .getSanitizedFilename();
+  }
+
+  @Test(expected = RuntimeException.class)
+  public void sanitizeThrowsOnParentAfterResolving() {
+    (new MultipartFormData.FilePart<Object>(null, "../a/..", null, null)).getSanitizedFilename();
+  }
+}