HttpPostedFile.FileName - Different from IE

Question

When I upload a file to a site using the ASP:File control the FileName property is different in IE and Firefox. In Firefox, it just provides the name of the file, but IE provides the full path to the file.

I have worked around this by adding the code:

Dim FileName As String = file.FileName
If FileName.LastIndexOf("\") > 0 Then
    FileName = FileName.Substring(FileName.LastIndexOf("\") + 1)
End If

But I'm not sure why that would be different between the different browsers. Does anyone know the reason for this?

Thanks.

The colon in the filename will cause a NotSupportedException if you try to save it using "new FileInfo(filePath)" — Josh Kodroff, Dec 08 '09 at 16:01

score 31 · Answer 1 · answered Oct 13 '11 at 08:16

31

A simple workaround for this tested in IE and Chrome

new FileInfo(myHttpPostedFileBase.FileName).Name

This will ensure you always get just the file name even if the path is included.

answered Oct 13 '11 at 08:16

SeeNoWeevil

2,549
4
26
39

1

The following piece of code is equivalent: `Path.GetFileNameWithoutExtension(myHttpPostedFileBase.FileName)` I have not checked if there's a performance difference. – Vincent Sels Nov 26 '14 at 16:13
7

@VincentSels This is equivalent: `Path.GetFileName(myHttpPostedFileBase.FileName)`, because it not removes file extension. – xonya Jul 08 '15 at 09:40
event this is not the answer to the question it helps. – Prageeth godage Sep 14 '16 at 17:43

score 12 · Accepted Answer · answered Dec 19 '08 at 23:54

12

This is a security/privacy concern, firefox/mozilla is doing it right and you will not get a way to get the full path without an add-in, applet, silverlight, flash or some other mechanism.

Here is more info on Mozilla's stance:

https://developer.mozilla.org/en/Updating_web_applications_for_Firefox_3

See the section on Security Changes->File upload fields

I hope IE will follow suit so we have a consistent and secure environment.

answered Dec 19 '08 at 23:54

Ryan Cook

9,275
5
38
37

IE has followed suit. In IE8 and above the default setting is to not send the full original file path. – scunliffe Jul 23 '12 at 11:31
IE didn't exactly "follow suit." IE8 and up allow the user to choose relative or absolute paths in form fields, but it's buried in security settings: http://msdn.microsoft.com/en-us/library/ie/ms535263%28v=vs.85%29.aspx – Big McLargeHuge Oct 03 '14 at 19:17
10

Just for reference, I'm using IE 11, and it's giving me the full path. That's how I found this question because I need to handle it. – Adrian Carr Oct 08 '14 at 10:33

score 7 · Answer 3 · edited May 29 '22 at 08:13

7

In IE8, this behavior has changed and it will ONLY pass the file name, not the full path. ;-)

Details and link to the IE Blog post discussing the change in IE8: Link

Serverside apps looking to parse out the filename should check for, but not expect there to be backslashes in the filename.

IE8 user setting override: Link

edited May 29 '22 at 08:13

Glorfindel

21,988
13
81
109

answered Dec 20 '08 at 00:27

scunliffe

62,582
25
126
161

1

Nope. My IE8 (No Compatibility mode) still transfers the whole path. – rudimenter Dec 23 '10 at 17:06
IIRC it does pass "a whole path" however the path it passes is faked... It it the real filename concatenated with a faked default path to ensure compatibility with servers expecting a full path. – scunliffe Dec 24 '10 at 19:49
5

IE8 will STILL transfer the full path name in the Intranet Zone by default. See [IE8 security blog](http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-protection.aspx). "Additionally, the “Include local directory path when uploading files” URLAction has been set to "Disable" for the Internet Zone. This change prevents leakage of potentially sensitive local file-system information to the Internet. For instance, rather than submitting the full path C:\users\ericlaw\documents\secret\image.png, Internet Explorer 8 will now submit only the filename image.png." – Spud Jul 23 '12 at 05:12
@Spud I think you might be misunderstanding how that setting works. In IE8 (and above), that setting is set to disabled... as in "IE will NOT send the full path"... http://blogs.iis.net/webtopics/archive/2009/07/27/uploading-a-file-using-fileupload-control-fails-in-ie8.aspx – scunliffe Jul 23 '12 at 11:29
@scunliffe Sorry, no misunderstanding :) The setting is indeed off for the INTERNET zone. However, it is still on for the INTRANET zone, where it WILL send the full path in IE8. So you will still see this happening in certain scenarios. – Spud Jul 23 '12 at 20:41
@Spud - doh, I misread the int[RA]net versus int[ER]net, you are correct! – scunliffe Jul 23 '12 at 20:51

score 4 · Answer 4 · answered May 27 '13 at 08:33

You also can use Path.GetFileName(File.FileName) that return only file name. Example:

Dim File As HttpPostedFile = context.Request.Files("txtFile")
' let's FileName is "d:\temp\1.txt"
Dim FileName As String = Path.GetFileName(File.FileName)
' FileName will be "1.txt"

HttpPostedFile.FileName - Different from IE

4 Answers4

Linked

Related