upload file - different browsers send different path name

[Minh Nam]

Hi guys,

I use the following code to save a uploaded file on server:

			List items = upload.parseRequest(request);
			Iterator iter = items.iterator();
			while (iter.hasNext()) {
				FileItem item = (FileItem) iter.next();

				if (!item.isFormField()) {
					String fieldName = item.getFieldName();
					String fileName = item.getName();
					String contentType = item.getContentType();
					long sizeInBytes = item.getSize();

					logger.info("fieldName = " + fieldName);
					logger.info("fileName = " + fileName);
					logger.info("contentType = " + contentType);
					logger.info("sizeInBytes = " + sizeInBytes);

					dataFile = uploadFolder + File.separator + item.getName();
					File uploadedFile = new File(dataFile);
					item.write(uploadedFile);
					
					logger.info("File saved on server");
				}
			}

If the file uploaded by Firefox, the fileName contains only file name.
If the file uploaded by IE, the fileName contains absolute path on client's computer which may exposes security threat.

So why's the different?

[Bear Bibeault]

That is a security bug in IE.

[Minh Nam]

Bear Bibeault wrote:That is a security bug in IE.

I tested with IE 6, maybe the later version fixes the bug.

[Minh Nam]

I have to use this workaround:

String fileName = new File(item.getName()).getName();