[Django] #37292: TemporaryUploadedFile raises OSError for a filename with a very long extension

[Django]

#37292: TemporaryUploadedFile raises OSError for a filename with a very long
extension
-------------------------------------+-------------------------------------
Reporter: Prakhar Pratyush | Type: Bug
Status: new | Component: File
| uploads/storage
Version: 5.2 | Severity: Normal
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Uploading a file whose extension is long enough makes the request die with
an unhandled `OSError` instead of the name being sanitized.

`TemporaryUploadedFile` takes the extension straight off the client-
supplied filename and uses it as the suffix of the temporary file:

{{{
_, ext = os.path.splitext(name)
file = tempfile.NamedTemporaryFile(
suffix=".upload" + ext, dir=settings.FILE_UPLOAD_TEMP_DIR
)
super().__init__(file, name, content_type, size, charset,
content_type_extra)
}}}

`NAME_MAX` is 255 bytes on ext4 and most other filesystems, and `tempfile`
adds "tmp" plus 8 random characters on top of the 7-byte ".upload", so an
extension of 238 bytes or more is enough to make `os.open()` fail.

=== Replication

{{{
>>> from django.core.files.uploadedfile import TemporaryUploadedFile
>>> TemporaryUploadedFile("x." + "a" * 250, "text/plain", 6, None)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/srv/zulip/.venv/lib/python3.10/site-
packages/django/core/files/uploadedfile.py", line 77, in __init__
file = tempfile.NamedTemporaryFile(
File "/usr/lib/python3.10/tempfile.py", line 714, in NamedTemporaryFile
file = _io.open(dir, mode, buffering=buffering,
File "/usr/lib/python3.10/tempfile.py", line 711, in opener
fd, name = _mkstemp_inner(dir, prefix, suffix, flags, output_type)
File "/usr/lib/python3.10/tempfile.py", line 395, in _mkstemp_inner
fd = _os.open(file, flags, 0o600)
OSError: [Errno 36] File name too long:
'/tmp/tmpm5gby_up.upload.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
}}}

**Also**:

Over a real request you need an upload larger than
`FILE_UPLOAD_MAX_MEMORY_SIZE` so that `MemoryFileUploadHandler` declines
it and the temporary file handler takes over. Anything that reads
`request.POST` on that request will then raise, it comes out as a 500.
--
Ticket URL: <https://code.djangoproject.com/ticket/37292>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#37292: TemporaryUploadedFile raises OSError for a filename with a very long
extension

--------------------------------------+------------------------------------
Reporter: Prakhar Pratyush | Owner: (none)

Type: Bug | Status: new
Component: File uploads/storage | Version: 5.2

Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

--------------------------------------+------------------------------------
Changes (by Yassin Bahri):

* stage: Unreviewed => Accepted

Comment:

I reproduced this against current `main` (`cccc004b46`) on Windows with
Python 3.14:

{{{
from django.conf import settings

settings.configure()

from django.core.files.uploadedfile import TemporaryUploadedFile

TemporaryUploadedFile(
"x." + "a" * 250,
"text/plain",
6,

None,
)
}}}

This raises an `OSError` while creating the underlying temporary file,
before `UploadedFile._set_name()` has an opportunity to sanitize the
public filename.

On Windows the error is:

{{{
OSError: [Errno 22] Invalid argument
}}}

The reported Linux reproduction raises `OSError: [Errno 36] File name too
long`.

I also traced the behavior to `6352d06cd0`, which added preservation of
the original extension in `TemporaryUploadedFile` for #26651. Before that
change, temporary uploads always used the fixed `.upload` suffix.

The ticket appears valid on current `main`. A regression test can be added
to `TemporaryUploadedFileTests` in `tests/files/tests.py`. The fix should
preserve ordinary extensions while bounding or omitting extensions that
cannot safely be used as part of a temporary filename.
--
Ticket URL: <https://code.djangoproject.com/ticket/37292#comment:1>

[Django]

#37292: TemporaryUploadedFile raises OSError for a filename with a very long
extension

-------------------------------------+-------------------------------------
Reporter: Prakhar Pratyush | Owner: Yassin
| Bahri
Type: Bug | Status: assigned
Component: File | Version: 5.2
uploads/storage |

Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

-------------------------------------+-------------------------------------
Changes (by Yassin Bahri):

* owner: (none) => Yassin Bahri
* status: new => assigned

--
Ticket URL: <https://code.djangoproject.com/ticket/37292#comment:2>

[Django]

#37292: TemporaryUploadedFile raises OSError for a filename with a very long
extension
-------------------------------------+-------------------------------------
Reporter: Prakhar Pratyush | Owner: Yassin
| Bahri
Type: Bug | Status: assigned
Component: File | Version: 5.2
uploads/storage |
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Yassin Bahri):

* has_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/37292#comment:3>

[Django]

#37292: TemporaryUploadedFile raises OSError for a filename with a very long
extension
-------------------------------------+-------------------------------------
Reporter: Prakhar Pratyush | Owner: Yassin
| Bahri
Type: Bug | Status: assigned
Component: File | Version: 5.2
uploads/storage |
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Yassin Bahri):

A patch is available at https://github.com/django/django/pull/21804.

The change preserves ordinary upload extensions but omits an extension
when its filesystem-encoded length would be unsafe for a temporary
filename.

Regression coverage was added for both long ASCII and multibyte
extensions. The complete `files` test module passes:

{{{
Ran 47 tests in 3.100s

OK
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/37292#comment:4>