Skip to content

UploadedFile chopping off everything before backslash in $originalName #62255

@hackel

Description

@hackel

Symfony version(s) affected

>=2.0.15

Description

When uploading a file that contains a backslash, UploadedFile calls the File::getName() method to set the $originalName property. This method chops off everything before the backslash to "sanitize" it. There is currently no way to get the full original filename other than searching through $_FILES manually. This was added way back in symfony/http-foundation@a3f936e!

How to reproduce

In http-foundation/Tests/File/UploadedFileTest.php:

    public function testGetClientOriginalNameWithBackslash()
    {
        $file = new UploadedFile(
            __DIR__.'/Fixtures/test.gif',
            'prefix\original.gif',
            'image/gif'
        );

        $this->assertEquals('prefix\original.gif', $file->getClientOriginalName());
    }

Possible Solution

Since other sanitization methods were rejected (e.g. #49283), I would propose that this isn't needed at all. However, if it is kept, then my suggestion is to simply replace the backslashes with a hyphen on Windows only, seeing as they are perfectly fine on other systems. I would be happy to provide a PR either way.

Additional Context

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions