Bug 754556

the problem is that:

            packageName = new File(packageName).getName();

runs on the server. If the server is running on Linux (though the file upload came from Windows and packageName is somethign like "C:\path\foo.txt") we can't assume that it will parse windows paths correctly. On linux, this returns "C:\path\foo.txt" if that is the value of packageName.

I tested uploading bundle files to see if the same problem happens - it doesn't. That works fine.

The issue is the form item "name" when uploading a package version is passed in with the IE filename (which includes the bogus fakepath).

So it looks like we need to be careful with all classes that subclass FileUploadServlet. Of the 4 that exist today, only PackageVersionFileUploadServlet appears to have this bug.

It uses:

   String packageName = getFormField(formFields, "name", file.getName());
   packageName = new File(packageName).getName();

This is code running in the server. If this is running on Linux, but we get a Windows path in the "name" form item (which happens if I upload via IE), then it won't do what you think it will - the File.getName() returns the full windows path (like "C:\fakepath\foo.txt").

We need to take out the new File() call and replace with a more generic method to strip the path to obtain the filename:

   String packageName = getFormField(formFields, "name", file.getName());
   packageName = FileUtil.getFileName(FileUtil.useForwardSlash(packageName), "/");

master commit: c9688a017c484af70bd731805ec5088deb2bf189
release_jon3.x commit: f204de0b5177073defba2f0add4fc0f70e2a4be6

issue is not specific to EAP 4.3.  related to file upload in general.

Verified on build#18 in rhq-release-gwt-locales branch.

Using IE8, successfully deployed a war file to the EAP 4.3 server. No errors are observed in agent log.

changing status of VERIFIED BZs for JON 2.4.2 and JON 3.0 to CLOSED/CURRENTRELEASE

marking VERIFIED JON 3 bugs to CLOSED/CURRENTRELEASE