Defect #44186
closed
Uploading files with excessively long extensions may fail
Description
When uploading a file with a very long extension, disk_filename might become too long to be stored on the server's filesystem, resulting in an exception such as:
Started POST "/uploads.js?attachment_id=2&filename=file.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&content_type=" for 127.0.0.1 at 2026-06-16 22:30:27 +0900
Processing by AttachmentsController#upload as JS
Parameters: {"attachment_id" => "2", "filename" => "file.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "content_type" => ""}
...
Completed 500 Internal Server Error in 57ms (ActiveRecord: 26.1ms (4 queries, 0 cached) | GC: 0.7ms)
Errno::ENAMETOOLONG (File name too long @ rb_sysopen - /app/redmine/files/2026/06/260616221802_ca16d684c42688ce3d106a0ff9454c3a.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa):
app/models/attachment.rb:611:in 'File#initialize'
app/models/attachment.rb:611:in 'IO.open'
app/models/attachment.rb:611:in 'Attachment.create_diskfile'
app/models/attachment.rb:150:in 'Attachment#files_to_final_location'
app/controllers/attachments_controller.rb:116:in 'AttachmentsController#upload'
lib/redmine/sudo_mode.rb:78:in 'Redmine::SudoMode::Controller#sudo_mode'
This patch uses the original file extension only when the resulting disk_filename (including the extension) is short enough.
This issue is similar to #24186. This patch follows the same filename length limit as that issue.
Files
Related issues
Updated by Go MAEDA 24 days ago
- Related to Patch #24186: Restrict the length attachment filenames on disk added
Updated by Go MAEDA 23 days ago
Thank you for catching and reporting the issue.
I will commit the patch with a slight change. It simplifies the length check by comparing the two lengths directly:
diff --git a/app/models/attachment.rb b/app/models/attachment.rb
index 2adfc9f9f..c94a96def 100644
--- a/app/models/attachment.rb
+++ b/app/models/attachment.rb
@@ -602,7 +602,7 @@ class Attachment < ApplicationRecord
else
ascii = ActiveSupport::Digest.hexdigest(filename)
# keep the extension if any
- if filename =~ %r{(\.[a-zA-Z0-9]+)$} && "#{ascii}#{$1}".length <= max_filename_length
+ if filename =~ %r{(\.[a-zA-Z0-9]+)$} && (ascii.length + $1.length) <= max_filename_length
ascii << $1
end
end
This expresses the constraint more directly: the generated base name plus the preserved extension must fit within max_filename_length. It also avoids creating a temporary interpolated string just to check its length.
Updated by Kenta Kumojima 23 days ago
Thank you for reviewing the patch.
I also think the proposed change is much easier to understand.
Updated by Marius BĂLTEANU 15 days ago
- Copied to Defect #44216: Backport uploading files with excessively long extensions may fail added
Updated by Marius BĂLTEANU 15 days ago
- Status changed from Resolved to Closed
- Target version changed from 6.1.4 to 7.0.0