CODEWITHSUNDEEP
securitybrowserfile-uploadhttppostedfile
Ryan Smith
Ryan Smith

Reputation: 8324

HttpPostedFile.FileName - Different from IE

When I upload a file to a site using the ASP:File control the FileName property is different in IE and Firefox. In Firefox, it just provides the name of the file, but IE provides the full path to the file.

I have worked around this by adding the code:

Dim FileName As String = file.FileName
If FileName.LastIndexOf("\") > 0 Then
    FileName = FileName.Substring(FileName.LastIndexOf("\") + 1)
End If

But I'm not sure why that would be different between the different browsers. Does anyone know the reason for this?

Thanks.

Upvotes: 25

Views: 21066

Answers (4)

scunliffe
scunliffe

Reputation: 63588

In IE8, this behavior has changed and it will ONLY pass the file name, not the full path. ;-)

Details and link to the IE Blog post discussing the change in IE8: Link

Serverside apps looking to parse out the filename should check for, but not expect there to be backslashes in the filename.

IE8 user setting override: Link

Upvotes: 7

feeeper
feeeper

Reputation: 3017

You also can use Path.GetFileName(File.FileName) that return only file name. Example:

Dim File As HttpPostedFile = context.Request.Files("txtFile")
' let's FileName is "d:\temp\1.txt"
Dim FileName As String = Path.GetFileName(File.FileName)
' FileName will be "1.txt"

Upvotes: 4

SeeNoWeevil
SeeNoWeevil

Reputation: 2619

A simple workaround for this tested in IE and Chrome

new FileInfo(myHttpPostedFileBase.FileName).Name

This will ensure you always get just the file name even if the path is included.

Upvotes: 31

Ryan Cook
Ryan Cook

Reputation: 9335

This is a security/privacy concern, firefox/mozilla is doing it right and you will not get a way to get the full path without an add-in, applet, silverlight, flash or some other mechanism.

Here is more info on Mozilla's stance:

https://developer.mozilla.org/en/Updating_web_applications_for_Firefox_3

See the section on Security Changes->File upload fields

I hope IE will follow suit so we have a consistent and secure environment.

Upvotes: 12

Related Questions