-
Bug
-
Resolution: Done
-
Major
-
1.3.25.Final
-
None
When a multipart request (file upload) with the following content disposition header is received by Undertow, the resulting Part will have name "MyFile.txt" instead of "file":
Content-Disposition: form-data; filename="MyFile.txt"; name="file"
The reason for this seems to be that io.undertow.util.Headers#extractQuotedValueFromHeader is buggy and will use the value of the "filename" field if it is asked to extract the "name" field.
I tested this using the following piece of code:
import io.undertow.util.Headers; class Test { public static void main(String[] args) { String res = Headers.extractQuotedValueFromHeader( "form-data; filename=\"myfile\"; name=\"file\"", "name"); System.out.println(res); } }
Running it will output "myfile" instead of the expected "file".
The Headers class is used during multipart extraction here:
https://github.com/undertow-io/undertow/blob/master/core/src/main/java/io/undertow/server/handlers/form/MultiPartParserDefinition.java#L239
A client that reproduces the given order of fields (filename first, then name) would be Jersey JAX-RS 2 with the Apache connector.