Serving Files with Spaces in the File Name Using CFContent

Posted: October 6, 2011 in ColdFusion

I ran into an issue where using CFContent to serve a file with spaces in its name was truncating the file name. For example the file “Foo Bar.xls” was saving as “Foo”, lacking ” Bar.xls”.

<cfheader name="Content-Disposition" value="attachment; filename=#getFileFromPath(filePath)#">
<cfcontent file="#filePath#" type="application/octet-stream">

You can find many examples of this type of code out there for securing files using ColdFusion and its cfcontent, so apparently it’s a common oversight.

The fix to truncated file names is very simple but no so obvious.

What doesn’t work:

  1. Don’t wrap the file name value in anything
  2. Wrapping the file name value in single quotes
  3. Wrapping the file name value in double quotes

What does work:

  1. Wrap the file name value in escaped quotes (doubled up such as “”#filename#””)
  2. Wrap the file name value in character valued double quotes (chr(34))

The new example would look something like this:

<cfheader name="Content-Disposition" value="attachment; filename=""#getFileFromPath(filePath)#""">
<cfcontent file="#filePath#" type="application/octet-stream">

Thanks to Ben Nadel for providing this solution.

See my previous blog on serving files with CFContent at https://christierney.com/2009/08/12/securely-serving-files-via-cfcontent/ .

Advertisements
Comments
  1. Nolan Erck says:

    Thanks for the post! This solved a headache I’d been having with a client’s app. 🙂

  2. martypaz says:

    I love finding the old gems… Thanks for this – I was trying spaces to plus signs, URL encoding but of course.. Wrap in quotes – Doh!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s