    001    /*
    002     * Licensed to the Apache Software Foundation (ASF) under one or more
    003     * contributor license agreements.  See the NOTICE file distributed with
    004     * this work for additional information regarding copyright ownership.
    005     * The ASF licenses this file to You under the Apache License, Version 2.0
    006     * (the "License"); you may not use this file except in compliance with
    007     * the License.  You may obtain a copy of the License at
    008     *
    009     *      http://www.apache.org/licenses/LICENSE-2.0
    010     *
    011     * Unless required by applicable law or agreed to in writing, software
    012     * distributed under the License is distributed on an "AS IS" BASIS,
    013     * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    014     * See the License for the specific language governing permissions and
    015     * limitations under the License.
    016     */
    017    package org.apache.commons.fileupload;
    018
    019
    020    /**
    021     * This exception is thrown in case of an invalid file name.
    022     * A file name is invalid, if it contains a NUL character.
    023     * Attackers might use this to circumvent security checks:
    024     * For example, a malicious user might upload a file with the name
    025     * "foo.exe\0.png". This file name might pass security checks (i.e.
    026     * checks for the extension ".png"), while, depending on the underlying
    027     * C library, it might create a file named "foo.exe", as the NUL
    028     * character is the string terminator in C.
    029     */
    030    public class InvalidFileNameException extends RuntimeException {
    031        private static final long serialVersionUID = 7922042602454350470L;
    032        private final String name;
    033
    034        /**
    035         * Creates a new instance.
    036         * @param pName The file name causing the exception.
    037         * @param pMessage A human readable error message.
    038         */
    039        public InvalidFileNameException(String pName, String pMessage) {
    040            super(pMessage);
    041            name = pName;
    042        }
    043
    044        /**
    045         * Returns the invalid file name.
    046         */
    047        public String getName() {
    048            return name;
    049        }
    050    }