HttpPostedFile.FileName - Different from IE

Question

When I upload a file to a site using the ASP:File control the FileName property is different in IE and Firefox. In Firefox, it just provides the name of the file, but IE provides the full path to the file.

I have worked around this by adding the code:

Dim FileName As String = file.FileName
If FileName.LastIndexOf("\") > 0 Then
    FileName = FileName.Substring(FileName.LastIndexOf("\") + 1)
End If

But I'm not sure why that would be different between the different browsers. Does anyone know the reason for this?

Thanks.

Cussedness

The colon in the filename will cause a NotSupportedException if you try to save it using "new FileInfo(filePath)" – Meningitis

Answer 1

This is a security/privacy concern, firefox/mozilla is doing it right and you will not get a way to get the full path without an add-in, applet, silverlight, flash or some other mechanism.

Here is more info on Mozilla's stance:

https://developer.mozilla.org/en/Updating_web_applications_for_Firefox_3

See the section on Security Changes->File upload fields

I hope IE will follow suit so we have a consistent and secure environment.

Sailmaker

IE has followed suit. In IE8 and above the default setting is to not send the full original file path. – Afflux

IE didn't exactly "follow suit." IE8 and up allow the user to choose relative or absolute paths in form fields, but it's buried in security settings: msdn.microsoft.com/en-us/library/ie/ms535263%28v=vs.85%29.aspx – Ardenardency

Just for reference, I'm using IE 11, and it's giving me the full path. That's how I found this question because I need to handle it. – Gunter

Answer 2

A simple workaround for this tested in IE and Chrome

new FileInfo(myHttpPostedFileBase.FileName).Name

This will ensure you always get just the file name even if the path is included.

Discommend

The following piece of code is equivalent: Path.GetFileNameWithoutExtension(myHttpPostedFileBase.FileName) I have not checked if there's a performance difference. – Endocranium

@VincentSels This is equivalent: Path.GetFileName(myHttpPostedFileBase.FileName), because it not removes file extension. – Gulden

event this is not the answer to the question it helps. – Discontinuance

Answer 3

In IE8, this behavior has changed and it will ONLY pass the file name, not the full path. ;-)

Details and link to the IE Blog post discussing the change in IE8: Link

Serverside apps looking to parse out the filename should check for, but not expect there to be backslashes in the filename.

IE8 user setting override: Link

Afflux

Nope. My IE8 (No Compatibility mode) still transfers the whole path. – Sumerian

IIRC it does pass "a whole path" however the path it passes is faked... It it the real filename concatenated with a faked default path to ensure compatibility with servers expecting a full path. – Afflux

IE8 will STILL transfer the full path name in the Intranet Zone by default. See IE8 security blog. "Additionally, the “Include local directory path when uploading files” URLAction has been set to "Disable" for the Internet Zone. This change prevents leakage of potentially sensitive local file-system information to the Internet. For instance, rather than submitting the full path C:\users\ericlaw\documents\secret\image.png, Internet Explorer 8 will now submit only the filename image.png." – Lepsy

@Lepsy I think you might be misunderstanding how that setting works. In IE8 (and above), that setting is set to disabled... as in "IE will NOT send the full path"... blogs.iis.net/webtopics/archive/2009/07/27/… – Afflux

@Afflux Sorry, no misunderstanding :) The setting is indeed off for the INTERNET zone. However, it is still on for the INTRANET zone, where it WILL send the full path in IE8. So you will still see this happening in certain scenarios. – Lepsy

@Lepsy - doh, I misread the int[RA]net versus int[ER]net, you are correct! – Afflux

Answer 4

You also can use Path.GetFileName(File.FileName) that return only file name. Example:

Dim File As HttpPostedFile = context.Request.Files("txtFile")
' let's FileName is "d:\temp\1.txt"
Dim FileName As String = Path.GetFileName(File.FileName)
' FileName will be "1.txt"

Teahan