diff --git a/core/src/main/java/io/undertow/UndertowMessages.java b/core/src/main/java/io/undertow/UndertowMessages.java index 6092986b01..a3e521e478 100644 --- a/core/src/main/java/io/undertow/UndertowMessages.java +++ b/core/src/main/java/io/undertow/UndertowMessages.java @@ -20,6 +20,7 @@ import java.io.IOException; import java.nio.channels.ClosedChannelException; +import java.nio.file.Path; import javax.net.ssl.SSLException; import javax.net.ssl.SSLHandshakeException; @@ -636,4 +637,10 @@ public interface UndertowMessages { @Message(id = 204, value = "Out of flow control window: no WINDOW_UPDATE received from peer within %s miliseconds") IOException noWindowUpdate(long timeoutMiliseconds); + + @Message(id = 205, value = "Path is not a directory '%s'") + IOException pathNotADirectory(Path path); + + @Message(id = 206, value = "Path '%s' is not a directory") + IOException pathElementIsRegularFile(Path path); } diff --git a/core/src/main/java/io/undertow/server/handlers/form/MultiPartParserDefinition.java b/core/src/main/java/io/undertow/server/handlers/form/MultiPartParserDefinition.java index 4ed527edf1..d7738bbe67 100644 --- a/core/src/main/java/io/undertow/server/handlers/form/MultiPartParserDefinition.java +++ b/core/src/main/java/io/undertow/server/handlers/form/MultiPartParserDefinition.java @@ -44,12 +44,15 @@ import java.nio.channels.FileChannel; import java.nio.charset.StandardCharsets; import java.nio.file.Files; +import java.nio.file.LinkOption; import java.nio.file.NoSuchFileException; import java.nio.file.Path; import java.nio.file.Paths; import java.nio.file.StandardOpenOption; +import java.nio.file.attribute.FileAttribute; import java.util.ArrayList; import java.util.Arrays; +import java.util.LinkedList; import java.util.List; import java.util.concurrent.Executor; @@ -251,7 +254,42 @@ public void beginPart(final HeaderMap headers) { if (fileName != null && fileSizeThreshold == 0) { try { if (tempFileLocation != null) { - file = Files.createTempFile(tempFileLocation, "undertow", "upload"); + //Files impl is buggy, hence zero len + final FileAttribute[] emptyFA = new FileAttribute[] {}; + final LinkOption[] emptyLO = new LinkOption[] {}; + final Path normalized = tempFileLocation.normalize(); + if (!Files.exists(normalized)) { + final int pathElementsCount = normalized.getNameCount(); + Path tmp = normalized; + LinkedList dirsToGuard = new LinkedList<>(); + for(int i=0;i