Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/Formidable.js
Original file line number Diff line number Diff line change
Expand Up @@ -614,6 +614,12 @@ class IncomingForm extends EventEmitter {
const firstInvalidIndex = Array.from(rawExtname).findIndex(invalidExtensionChar);
if (firstInvalidIndex === -1) {
filtered = rawExtname;
} else if (firstDot !== lastDot) {
// The multi-dot extension contains invalid characters (e.g. "test(.123).pdf").
// Fall back to path.extname so the actual file extension is preserved.
const lastExtname = path.extname(basename);
const lastInvalidIndex = Array.from(lastExtname).findIndex(invalidExtensionChar);
filtered = lastInvalidIndex === -1 ? lastExtname : lastExtname.substring(0, lastInvalidIndex);
} else {
filtered = rawExtname.substring(0, firstInvalidIndex);
}
Expand Down
18 changes: 14 additions & 4 deletions test/unit/formidable.test.js
Original file line number Diff line number Diff line change
Expand Up @@ -105,14 +105,24 @@ function makeHeader(originalFilename) {
expect(ext).toBe('.QxZs');

basename = getBasename('test.pdf.jqlnn<img src=a onerror=alert(1)>.png');
expect(basename).toHaveLength(35);
expect(basename).toHaveLength(29);
ext = path.extname(basename);
expect(ext).toBe('.png');

// files where the first-dot segment contains invalid chars should fall
// back to path.extname so the real extension is preserved (issue #980)
basename = getBasename({ originalFilename: 'test(.123).pdf' });
ext = path.extname(basename);
expect(ext).toBe('.pdf');

basename = getBasename({ originalFilename: 'EERS 1.1-CUR.pdf' });
ext = path.extname(basename);
expect(ext).toBe('.jqlnn');
expect(ext).toBe('.pdf');

basename = getBasename('test.<a.png');
expect(basename).toHaveLength(25);
expect(basename).toHaveLength(29);
ext = path.extname(basename);
expect(ext).toBe('');
expect(ext).toBe('.png');
});

test(`${name}#_Array parameters support`, () => {
Expand Down