Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-993

Name of Multipart Parts is parsed incorrectly when filename property comes first

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major Major
    • 2.0.0.Beta1, 1.4.11.Final
    • 1.3.25.Final
    • Core
    • None

      When a multipart request (file upload) with the following content disposition header is received by Undertow, the resulting Part will have name "MyFile.txt" instead of "file":

      Content-Disposition: form-data; filename="MyFile.txt"; name="file"
      

      The reason for this seems to be that io.undertow.util.Headers#extractQuotedValueFromHeader is buggy and will use the value of the "filename" field if it is asked to extract the "name" field.

      I tested this using the following piece of code:

      import io.undertow.util.Headers;
      
      class Test {
          public static void main(String[] args) {
              String res = Headers.extractQuotedValueFromHeader(
                      "form-data; filename=\"myfile\"; name=\"file\"",
                      "name");
              System.out.println(res);
          }
      }
      

      Running it will output "myfile" instead of the expected "file".

      The Headers class is used during multipart extraction here:
      https://github.com/undertow-io/undertow/blob/master/core/src/main/java/io/undertow/server/handlers/form/MultiPartParserDefinition.java#L239

      A client that reproduces the given order of fields (filename first, then name) would be Jersey JAX-RS 2 with the Apache connector.

            sdouglas1@redhat.com Stuart Douglas
            sebastian-ge Sebastian Hartte (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: