PH62271: javax.servlet.http.Part#write(fileName) does not write to absolute locations during file uploads

APAR status

• Closed as program error.

Error description

• javax.servlet.http.Part#write(fileName) does not write to
  absolute locations. This can result in FileNotFoundExceptions.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server version    *
  *                  9.0.5 and WebSphere Liberty Users           *
  ****************************************************************
  * PROBLEM DESCRIPTION: javax.servlet.http.Part#write(fileName) *
  *                      does not write to absolute locations    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When trying to call javax.servlet.http.Part#write(fileName),
  the server will save the filename under its temporary
  location, even if an absolute filename path is given.
  For example, if the temporary location is
  â?¦/wlp/usr/servers/defaultServer/workarea/org.eclipse.osgi/145/
  da
  ta/temp/ and the filename is /opt/fileuploads/test.txt then
  the server will write the file to
  â?¦/wlp/usr/servers/defaultServer/workarea/org.eclipse.osgi/145/
  da
  ta/temp/opt/fileuploads/test.txt rather than just the absolute
  location specified.
  This may cause some applications to encounter a
  FileNotFoundException if they are expecting the file to be
  written to the filename location.
  The Part#write description changed in servlet 5.0, but the
  Liberty implementation was never updated. The spec issue can
  be found at https://github.com/jakartaee/servlet/issues/274
  

Problem conclusion

• A new custom webcontainer property has been added:
  com.ibm.ws.webcontainer.allowabsolutefilenameforpartwrite
  
  When set to true, and a filename with an absolute path is used
  on the Part#write call, the server will write the file to the
  specified location. By default it is false, to prevent
  behavior changes.  However, for servlet-6.1, an upcoming EE11
  feature, the default is true to comply with the servlet
  specification.
  
  In Liberty, it can be set via â??<webContainer
  allowAbsoluteFileNameForPartWrite=â??trueâ?? />â?? in the server
  
  This fix is targeted for inclusion in WebSphere 9.0.5.23 and
  already included in Liberty 24.0.0.10.
  
  The github link can be found here:
  https://github.com/OpenLiberty/open-liberty/issues/29055
  
  For more information, see 'Recommended Updates for WebSphere
  Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels