Bug 63388 - Using FormData to upload a DataTransferItem generated random filename
Summary: Using FormData to upload a DataTransferItem generated random filename
Status: UNCONFIRMED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Platform (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-06-25 13:24 PDT by Alfonso Martínez de Lizarrondo
Modified: 2011-06-26 00:34 PDT (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alfonso Martínez de Lizarrondo 2011-06-25 13:24:05 PDT
With https://bugs.webkit.org/show_bug.cgi?id=58106 it's possible to get access to a pasted image in the paste event and as explained here http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2011-March/030881.html it's a Blob

Then that Blob can be send to the server with FormData:
	var formdata = new FormData();
	formdata.append("upload", file);
	xhr.send(formdata);

But that will set only the name of the form element ("upload") that can be used at the server to read the file. The filename itself will be a random string like Blob8edfed3b35de4b39a42a69f96081e5d1 that doesn't include even the '.png' extension

So if the server is performing some basic filtering according to the uploaded filenames, that file will be rejected.
If the server doesn't add itself the '.png' extension, then it might not be sent back when the client request it (due to a security policy to not send unknown file types)

Possible solutions: 
Generate a more useful automatic filename
allow to specify a filename in the formdata.append, or the blob
allow to get the whole blob as a string and then perform a sendAsBinary like Firefox where we can build the exact form specifying everything