#18150: Uploading a file ending with a backslash fails
-------------------------------------+-------------------------------------
Reporter: Peter Kuma | Owner:
Type: Bug | supersteve9219
Component: File | Status: assigned
uploads/storage | Version: 1.4
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by supersteve9219):
I added an updated patch. The file name was also being sanitized in
django/core/files/uploadedfile.py.
I added an if statement that checks if the last character in a file name
is "\", if it does not end in "\" normal sanitation continues, however, if
it does end in "\" it replaces the "\" with "0", we could simply strip the
"\" from the end of the file name but if there is multiple backslashes at
the end or the file name is a single backslash it could result in a empty
string for the file name.
I also attached django\tests\regressiontests\file_uploads\test.py with a
test method I added to test for this bug, it fails with the same error
mentioned in the bug report, but passes without issue after the patch is
applied.
Here is the test method alone:
{{{
def test_fail_backslash(self):
"""Tests filename ending with a backslash, issue #18150 reports
crashes when a filename ends with a backslash"""
backSlashName = "backslash.jpg\\"
payload = client.FakePayload()
payload.write('\r\n'.join([
'--' + client.BOUNDARY,
'Content-Disposition: form-data; name="file1"; filename="%s"'
% backSlashName,
'Content-Type: application/octet-stream',
'',
''
]))
payload.write('\r\n--' + client.BOUNDARY + '--\r\n')
r = {
'CONTENT_LENGTH': len(payload),
'CONTENT_TYPE': client.MULTIPART_CONTENT,
'PATH_INFO': "/file_uploads/echo/",
'REQUEST_METHOD': 'POST',
'wsgi.input': payload,
}
response = self.client.request(**r)
self.assertEqual(response.status_code, 200)
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/18150#comment:4>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
