-
Enhancement
-
Resolution: Won't Fix
-
P4
-
16
A DESCRIPTION OF THE PROBLEM :
For some operating systems, most notably Windows, certain Path element names are reserved and have a special meaning, e.g. NUL. Applications which want to protected against vulnerabilities form such reserved names may wish to validate that a user-provided file name is not reserved before trying to create a file with that name.
However, for Windows there are a lot of reserved names and the rules for whether a name is reserved are complex:
- Even Windows own documentation is incomplete: https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file#naming-conventions
Wikipedia lists more reserved names (https://en.wikipedia.org/wiki/Filename#Reserved_characters_and_words), but it is incomplete as well because there is also `CONIN$` and `CONOUT$` (https://docs.microsoft.com/en-us/windows/console/console-handles)
- Windows file names are case insensitive, which applies to reserved names as well (though which rules / Unicode standard is used?)
- Reserved names are still reserved when they have an "extension" (but what exactly is considered an "extension"?), e.g. `NUL.txt`
- Trailing periods and spaces are ignored when determining whether a file name is reserved
Since the rules are so complex, it is very likely that applications implement detection incompletely or incorrectly.
It would therefore be good if the JDK offered a method for this, e.g.:
FileSystem.isReservedPathNameElement(String): boolean
Ideally this would for Windows use an OS API determining whether a name is reserved. If there is no such API, then the rules (as outlined above, though might be incomplete) have to implemented manually.
For reference, Python has such a function: https://docs.python.org/3/library/pathlib.html#pathlib.PurePath.is_reserved
For some operating systems, most notably Windows, certain Path element names are reserved and have a special meaning, e.g. NUL. Applications which want to protected against vulnerabilities form such reserved names may wish to validate that a user-provided file name is not reserved before trying to create a file with that name.
However, for Windows there are a lot of reserved names and the rules for whether a name is reserved are complex:
- Even Windows own documentation is incomplete: https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file#naming-conventions
Wikipedia lists more reserved names (https://en.wikipedia.org/wiki/Filename#Reserved_characters_and_words), but it is incomplete as well because there is also `CONIN$` and `CONOUT$` (https://docs.microsoft.com/en-us/windows/console/console-handles)
- Windows file names are case insensitive, which applies to reserved names as well (though which rules / Unicode standard is used?)
- Reserved names are still reserved when they have an "extension" (but what exactly is considered an "extension"?), e.g. `NUL.txt`
- Trailing periods and spaces are ignored when determining whether a file name is reserved
Since the rules are so complex, it is very likely that applications implement detection incompletely or incorrectly.
It would therefore be good if the JDK offered a method for this, e.g.:
FileSystem.isReservedPathNameElement(String): boolean
Ideally this would for Windows use an OS API determining whether a name is reserved. If there is no such API, then the rules (as outlined above, though might be incomplete) have to implemented manually.
For reference, Python has such a function: https://docs.python.org/3/library/pathlib.html#pathlib.PurePath.is_reserved
- relates to
-
JDK-8274122 java/io/File/createTempFile/SpecialTempFile.java fails in Windows 11
- Resolved