ring-clojure / ring-clojure/ring
Handling invalid file names in multipart middleware
Nobody has claimed this yet.
- Dominant language
- Clojure
- Stars
- 3.9k
- Forks
- 528
- PR merge metrics
- No merged PRs in 30d
Description
I just spotted this stracktrace in our logs, as someone tried to mess with our servers:
org.apache.commons.fileupload.InvalidFileNameException: Invalid file name: DwldYyIuSimpleASP6qrV.asp\0.svg
at org.apache.commons.fileupload.util.Streams.checkFileName(Streams.java:189) ~[acme-1.56.33-standalone.jar:na]
at org.apache.commons.fileupload.FileUploadBase$FileItemIteratorImpl$FileItemStreamImpl.getName(FileUploadBase.java:829) ~[acme-1.56.33-standalone.jar:na]
at ring.middleware.multipart_params$parse_file_item.invokeStatic(multipart_params.clj:86) ~[acme-1.56.33-standalone.jar:na]
I'd prefer returning a 400 response, with a message about an invalid filename, but I can't see a way to do that, so this results in a 500 catch-all response. Am I missing something?
If not, would you welcome a PR?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at ring.middleware.multipart_params/parse_file_item in multipart_params.clj:86, identified in the stack trace, and trace how InvalidFileNameException propagates through the multipart middleware. Confirm the expected response handling for an invalid filename, with the work complete when this request produces a 400 response and an invalid-filename message instead of the 500 catch-all.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- clojure, java
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100