ValidatePath problem with files named "con.(something else)".

[psp589]

When I call ValidatePath(@"D:\ConsoleApplication1\ConsoleApplication1",@"D:\ConsoleApplication1\ConsoleApplication1\bin\Debug\con.img.jpg") I get an ArgumentException("Invalid path")

Problem is I have found .Net method Path.GetFullPath doesn't work properly with filenames equals to "con" or that start with "con.". This could be because "con" is something of the operating system (not sure)
Here is a sample of the output I get calling Path.GetFullPath:

Console.WriteLine(Path.GetFullPath("con")); //Output: \\.\con
            Console.WriteLine(Path.GetFullPath("con.img.jpg")); //Output: \\.\con
            Console.WriteLine(Path.GetFullPath("congress.img.jpg")); //Output: D:\ConsoleApplication1\ConsoleApplication1\bin\Debug\congress.img.jpg

So I would need to add a patch here: https://github.com/OrchardCMS/Orchard/blob/dev/src/Orchard/Validation/PathValidation.cs to support files with "con.". Any proposal that doesn't compromise security?

[sebastienros]

We need to ensure why there is this behavior in the first place before deciding on the solution.

[jchenga]

According to this MSDN page, :

Do not use the following reserved names for the name of a file:
CON, PRN, AUX, NUL, COM1, COM2, COM3, COM4, COM5, COM6, COM7, COM8, COM9, LPT1, LPT2, LPT3, LPT4, LPT5, LPT6, LPT7, LPT8, and LPT9. Also avoid these names followed immediately by an extension; for example, NUL.txt is not recommended.

[sebastienros]

Then I assume we can add a list with all these exceptions and validate the the file names don't contain it. I am not sure if we can expose a meaningful message though. Or could it be at a layer closer to the UI where users can provide filename.

[jchenga]

@sebastienros
We don't need to explicitly validate file names against a list of reserved words. The current implementation implicitly does that already.

I think we just need to throw an exception to indicate the given path is invalid and the hosted environment is on a Windows platform. Any caller down the call stack can catch this type of exception and display whatever info it wants.

Here is what I propose to do:

1. Create a custom exception called OrchardWindowsInvalidPathException.
2. throw this exception in PathValidation.ValidatePath if path is invalid and Environment.OSVersion is Windows.
3. the controller, or part driver can catch this specific exception and display a more meaningful message. e.g.

"Can't rename the file. Make sure your file name does begin with Con, NUL, COM, etc. followed immediately by an extension."