-1

i'm using OutputStream to create a pdf file for download as follow:

    byte[] infoFile = info.getBytes();
    String infoName = info.getFileName();
    String contentType = info.getContentType();
        
    response.setContentType(contentType);
    response.setHeader("Content-disposition", "attachment;filename=\"" + infoName + "\"");
    response.setContentLength(infoFile.length);
        
    // till now no problem, the file name is ok

    OutputStream out = response.getOutputStream();
    out.write(infoFile); 
    //here, as soon as the previous line is executed a file is generated with wrong characters
    // ex. D:__Profiles__User__Downloads__infoFile.pdf

Here the file produced is something like "D:__Profiles__User__Downloads__infoFile.pdf" while i expect the file "D:\Profiles\User\Downloads\infoFile.pdf"

What's wrong?

2
  • What is the value of infoName? And "where" exactly is the name generated with wrong characters?
    – Progman
    Sep 14, 2020 at 9:19
  • Java OutputStream doesn't produce directories at all, nor characters either. NB You don't need to set the Content-length.
    – user207421
    Sep 14, 2020 at 9:48

1 Answer 1

2

What's wrong?

Your expectation that the filename in a Content-disposition header should have path information.

From RFC 6266 section 4.3

Recipients MUST NOT be able to write into any location other than one to which they are specifically entitled. To illustrate the problem, consider the consequences of being able to overwrite well-known system locations (such as "/etc/passwd"). One strategy to achieve this is to never trust folder name information in the filename parameter, for instance by stripping all but the last path segment and only considering the actual filename (where 'path segments' are the components of the field value delimited by the path separator characters "" and "/").

And similarly in the Mozilla docs

The filename is always optional and must not be used blindly by the application: path information should be stripped, and conversion to the server file system rules should be done.

Basically you should only be specifying infoFile.pdf. It's up to the user which directory that file is saved in.

4
  • Indeed. It makes little sense to specify a full path when a file may be downloaded by something that doesn't have the same filesystem. Or, indeed, any filesystem. Sep 14, 2020 at 9:36
  • @Jon Skeet: Thank you. Your comment is really informative. It helped me to understand certain things. Btw, my problem is that OutputStream creates wrong characters in the file name. This old code is not mine, i just intervened to fix this behaviour. I ended up changing on the fly the file name as follow: code String baseUrl = String newFilePath = FilenameUtils.getBaseName(infoName) + "." + FilenameUtils.getExtension(infoName ); FilenameUtils.getPath(infoName); code Using this workaround the file is presented in the right way.
    – AmiStack
    Sep 14, 2020 at 14:26
  • 1
    @AmiStack: It's important to note that your emphasis on OutputStream is misplaced. OutputStream itself is just an abstract class. It doesn't have any concept of files at all. It's the getOutputStream() method that would be deciding what concrete subclass of OutputStream to use, and how to configure it. (Unfortunately we don't even know the type of response, so it's hard to say any more than that.)
    – Jon Skeet
    Sep 14, 2020 at 15:26
  • Thank you for the clarification. My mistake.
    – AmiStack
    Sep 14, 2020 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.