Ben Nadel
On User Experience (UX) Design, JavaScript, ColdFusion, Node.js, Life, and Love.
I am the chief technical officer at InVision App, Inc - a prototyping and collaboration platform for designers, built by designers. I also rock out in JavaScript and ColdFusion 24x7.
Meanwhile on Twitter
Loading latest tweet...
Ben Nadel at RIA Unleashed (Nov. 2010) with:

CFFile Upload - The Filename, Directory Name, Or Volume Label Syntax Is Incorrect

Posted by Ben Nadel
Tags: ColdFusion

In all the years that I've been using ColdFusion, I've never really had a problem with CFFile Upload (ie. CFFile action=upload). It just works; and it's awesome. The other day, however, I started getting this really odd error from my ColdFusion CFFile tag:

The filename, directory name, or volume label syntax is incorrect.

Since nothing around this code had changed recently, I knew the upload directory existed. And, when I tried to duplicate the behavior on my local machine, it always worked. I felt stumped.

Then, I realized something: My local machine and my server are running on two different operating systems. I run locally on Mac OSX; and the server runs on Windows 2008. Two different file systems, two different sets of file system restrictions.

The Mac OS is very flexible when it comes to filenames. Almost anything will be allowed. Windows, on the other hand, is much more restrictive; it has a sizable set of characters that can't be used in filenames, such as (but not limited to):

< > : " / \ | ? *

The ColdFusion CFFile syntax error that I had was being caused by a user on a Mac uploading a Windows-invalid file to the Windows server. When the CFFile tag went to write the file to disk, it was trying to use the client filename. And, rather than intelligently renaming it, the CFFile tag was simply raising an exception.

To get around this problem, I changed my CFFile Upload tag to use an explicit filename. Typically, when I use CFFile Upload, I provide a destination directory. And, when you do this, ColdFusion attempts to use the filename provided by the client. If you provide an explicit filename, however, ColdFusion will try to use that instead.

NOTE: I could have totally sworn that this latter behavior (supplying an explicit filename) was deprecated in ColdFusion 7 or thereabouts. And, while I cannot find this sentiment in any of the documentation, I will point out that all instances of the ColdFusion documentation refer to a "destination directory" and never to a destination filename.

  • <!---
  • When saving the file, don't let ColdFusion try to use the
  • client filename as the server-side filename (since this can
  • cause syntax errors). Instead, give it an explicitly safe name.
  •  
  • NOTE: NameConflict=MakeUnique will still work with this approach,
  • even if we are explicitly defining a name.
  • --->
  • <cffile
  • result="upload"
  • action="upload"
  • filefield="file"
  • destination="#expandPath( './uploads/upload.data' )#"
  • nameconflict="makeunique"
  • />
  •  
  • <!--- Output the resultant meta data. --->
  • <cfdump
  • var="#upload#"
  • label="Upload Meta Data"
  • output="#expandPath( './log.txt' )#"
  • format="text"
  • />

Notice that I am explicitly telling ColdFusion to use the filename, "upload.data". Also notice that the NameConflict attribute still works when you use an explicit filename, as demonstrated in this CFDump output:

Upload Meta Data - struct

ATTEMPTEDSERVERFILE: upload.data
CLIENTDIRECTORY: /Sites/bennadel.com/testing/cffile-upload-filename
CLIENTFILE: contacts.txt
CLIENTFILEEXT: txt
CLIENTFILENAME: contacts
CONTENTSUBTYPE: plain
CONTENTTYPE: text
DATELASTACCESSED: {d '2013-03-22'}
FILEEXISTED: YES
FILESIZE: 27
FILEWASAPPENDED: NO
FILEWASOVERWRITTEN: NO
FILEWASRENAMED: YES
FILEWASSAVED: YES
OLDFILESIZE: 27
SERVERDIRECTORY: /Sites/bennadel.com/testing/cffile-upload-filename/uploads
SERVERFILE: upload8.data
SERVERFILEEXT: data
SERVERFILENAME: upload8
TIMECREATED: {ts '2013-03-22 09:04:34'}
TIMELASTMODIFIED: {ts '2013-03-22 09:04:34'}

Notice that ColdFusion attempted to use "upload.data", but ended up having to use, "upload8.data" due to name collisions. Furthermore, the ColdFusion CFFile meta data still gives us access to the client filename, "contacts.txt", even when we tell ColdFusion to use the filename "upload.data" when attempting to save the file.

I'm not sure how I feel about using an explicit filename; perhaps that unease is due to years of not using it. Perhaps it's due to a belief that this behavior was deprecated. And, perhaps it's time to change my attitude and start using this approach; in addition to getting around this ColdFusion syntax error, supplying an explicit filename has obvious security benefits.




Reader Comments

You know, I knew the CF would allow you to specify the filename, but I didn't tend to let it do that because I wanted to be able to handle different extensions (whether I was uploading an image or some sort of document). I would write logic to make sure that the filename I ended up with had the correct extension.

When it came to uploading files, I tended to run into a different problem: some users would use a full-fledged description as the filename and the field in the database was limited to 255 characters. (Yes, they were using filenames that were longer than that!)

I got to the point where I would define my own filename and the user would only be aware of what the filename had become if they cared to pay attention to the HREF.

Reply to this Comment

@Paul,

Yeah, the size of filenames can be shocking. I'm not the most super organized person; but sometimes, I see people with filenames that make me think, "that's the craziest thing I've ever seen. How do you find anything!"

Reply to this Comment

Java instructors in college may be partly at fault for the long filenames and getting their students in the habit of using long names. I remember my Java instructors encouraging us to use extremely long names and not abbreviate at all. They told us the filenames should be descriptive and abbreviations weren't allowed at all.

Reply to this Comment

Post A Comment

?
You — Get Out Of My Dreams, Get Into My Comments
Live in the Now
Oops!
Comment Etiquette: Please do not post spam. Please keep the comments on-topic. Please do not post unrelated questions or large chunks of code. And, above all, please be nice to each other - we're trying to have a good conversation here.