{"action":"opened","issue":{"url":"https://api.github.com/repos/primefaces/primefaces/issues/506","labels_url":"https://api.github.com/repos/primefaces/primefaces/issues/506/labels{/name}","comments_url":"https://api.github.com/repos/primefaces/primefaces/issues/506/comments","events_url":"https://api.github.com/repos/primefaces/primefaces/issues/506/events","html_url":"https://github.com/primefaces/primefaces/issues/506","id":94151063,"number":506,"title":"p:fileUpload handles files with semicolon in name improperly","user":{"login":"tomi213","id":1575844,"avatar_url":"https://avatars.githubusercontent.com/u/1575844?v=3","gravatar_id":"","url":"https://api.github.com/users/tomi213","html_url":"https://github.com/tomi213","followers_url":"https://api.github.com/users/tomi213/followers","following_url":"https://api.github.com/users/tomi213/following{/other_user}","gists_url":"https://api.github.com/users/tomi213/gists{/gist_id}","starred_url":"https://api.github.com/users/tomi213/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tomi213/subscriptions","organizations_url":"https://api.github.com/users/tomi213/orgs","repos_url":"https://api.github.com/users/tomi213/repos","events_url":"https://api.github.com/users/tomi213/events{/privacy}","received_events_url":"https://api.github.com/users/tomi213/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-07-09T21:02:43Z","updated_at":"2015-07-09T21:02:43Z","closed_at":null,"body":"If I try to upload a file that contains semicolon in the name the file name, the file name gets clipped. \r\nEg. file \"my.exe;image.jpg\" is renamed to \"my.exe\". This allows the person that is uploading the file to bypass allowTypes feature and potentially upload files with any extension.\r\n\r\nFile name is shown correctly on the web page before upload, but when I push the file name to p:growl from the backing bean the name gets clipped.\r\n\r\nI used following libraries:\r\nprimefaces-5.2.jar\r\njavax.servlet-api-3.0.1.jar\r\njsf-api-2.2.10.jar\r\njsf-impl-2.2.10.jar\r\n\r\nJDK 1.8\r\nApache Tomcat 8.0.15.0\r\n\r\n\r\nfragment from xhtml file:\r\n```\r\n <h:form enctype=\"multipart/form-data\">\r\n            <p:growl id=\"messages\" showDetail=\"true\" />\r\n            <p:fileUpload value=\"#{uploadBean.file}\" mode=\"simple\" skinSimple=\"true\" \r\n                   allowTypes=\"/(\\.|\\/)(gif|jpe?g|png)$/\"/>\r\n            <p:commandButton value=\"Submit\" ajax=\"false\" \r\n                   actionListener=\"#{uploadBean.uploadOne()}\"/>\r\n </h:form>\r\n```\r\nUploadBean.java:\r\n\r\n```\r\nimport javax.faces.application.FacesMessage;\r\nimport javax.faces.bean.ManagedBean;\r\nimport javax.faces.context.FacesContext;\r\nimport org.primefaces.model.UploadedFile;\r\n\r\n@ManagedBean\r\npublic class UploadBean {\r\n    UploadedFile file;\r\n    public UploadedFile getFile() { \r\n           return file; \r\n   }\r\n   public void setFile(UploadedFile file) { \r\n        this.file = file;\r\n   }\r\n\r\n    public void uploadOne() {\r\n        if(file != null) {\r\n            FacesMessage message = new FacesMessage(\"Succesful\", file.getFileName() + \r\n                    \" is uploaded.\");\r\n            FacesContext.getCurrentInstance().addMessage(null, message);\r\n           //...\r\n        }\r\n    }\r\n}\r\n```"}}