Fix example to only use last part of filename #8007
Conversation
gmethvin
force-pushed
the
filename-fix
branch
from
63291e2
to
c77c763
Compare
|
|
||
| // only get the last part of the filename | ||
| // otherwise someone can send a path like ../../home/foo/bar.txt to write to other files on the system | ||
| val filename = Paths.get(picture.filename).getFileName |
There was a problem hiding this comment.
What do you think about making it so that request.body.file("foo") does this by default internally? Are there any valid use-cases for file uploads containing actual path fragments? Path traversal vulnerabilities can be pretty messy, and a secure-by-default solution seems preferable.
(If that's not feasible because of backwards compatibility, what about adding a sanitizedFileName method to the FilePart case class, that automatically does this?)
There was a problem hiding this comment.
@PainterAndHacker I was thinking that as well. I wanted to get this documentation fix in first so we can apply it to older branches of Play, but I do think we should have a way to access a sanitized version in Play's API. I opened issue #8008 for this.
There was a problem hiding this comment.
Are there any valid use-cases for file uploads containing actual path fragments?
There is https://developer.mozilla.org/en-US/docs/Web/API/HTMLInputElement/webkitdirectory.
Fixes #8000