Repository navigation
Conversation
…ile uploads UploadedFile.getOriginalName() returns the file name exactly as the client sent it in the multipart Content-Disposition header, including any directory part. The framework itself never uses that value as a path (the stored temp file is always UUID-named), but the legacy FileUploadInterceptor path stripped it via FilenameUtils.getName() before 7.0, and the replacement ActionFileUploadInterceptor/UploadedFilesAware API passes the raw value through unchanged. Adds UploadedFile#getSanitizedOriginalName() (basename only, via FilenameUtils.getName), alongside the existing raw accessor, with javadoc on both making the raw/sanitised distinction explicit. The showcase upload actions, which only ever use the name for display, switch to the sanitised accessor. Tests: AbstractMultiPartRequestTest gains a benign-marker test proving the raw accessor is unsanitised and the new sanitised one is not. Full core suite: 3742/0 failures (includes JakartaMultiPartRequestTest 42/42, JakartaStreamMultiPartRequestTest 43/43). apps/showcase changes are mechanical 1-line accessor swaps with no test asserting the exact filename string; could not run its own suite in this environment due to an unrelated, pre-existing local dependency gap in plugins/tiles (struts2-velocity-tools- view-jakarta never built on this machine), confirmed unrelated to this change by inspection.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes WW-5840
UploadedFile.getOriginalName()returns the file name exactly as the client sent it, including any directory part. The framework itself never uses that value as a path (the stored temp file is always UUID-named), but the replacementActionFileUploadInterceptor/UploadedFilesAwareAPI passes it through unchanged, unlike the legacy pre-7.0 path which stripped it.UploadedFile#getSanitizedOriginalName()(basename only), alongside the existing raw accessor, with javadoc on both making the distinction explicit.Verified:
AbstractMultiPartRequestTestgains a benign-marker test proving the raw accessor is unsanitised and the new one is not. Fullcore: 3742/0 failures (JakartaMultiPartRequestTest42/42,JakartaStreamMultiPartRequestTest43/43).apps/showcasechanges are mechanical 1-line accessor swaps with no test asserting the exact filename string.