diff --git a/spring-web/src/main/java/org/springframework/http/codec/multipart/FilePart.java b/spring-web/src/main/java/org/springframework/http/codec/multipart/FilePart.java index 6194e659b8..0b5b26d90a 100644 --- a/spring-web/src/main/java/org/springframework/http/codec/multipart/FilePart.java +++ b/spring-web/src/main/java/org/springframework/http/codec/multipart/FilePart.java @@ -36,7 +36,9 @@ public interface FilePart extends Part { *

Note: Please keep in mind this filename is supplied * by the client and should not be used blindly. In addition to not using * the directory portion, the file name could also contain characters such - * as ".." and others that can be used maliciously. + * as ".." and others that can be used maliciously. It is recommended to not + * use this filename directly. Preferably generate a unique one and save + * this one one somewhere for reference, if necessary. * @return the original filename, or the empty String if no file has been chosen * in the multipart form, or {@code null} if not defined or not available * @see RFC 7578, Section 4.2 diff --git a/spring-web/src/main/java/org/springframework/web/multipart/MultipartFile.java b/spring-web/src/main/java/org/springframework/web/multipart/MultipartFile.java index 7025c7d99e..e92a6c47fe 100644 --- a/spring-web/src/main/java/org/springframework/web/multipart/MultipartFile.java +++ b/spring-web/src/main/java/org/springframework/web/multipart/MultipartFile.java @@ -56,7 +56,9 @@ public interface MultipartFile extends InputStreamSource { *

Note: Please keep in mind this filename is supplied * by the client and should not be used blindly. In addition to not using * the directory portion, the file name could also contain characters such - * as ".." and others that can be used maliciously. + * as ".." and others that can be used maliciously. It is recommended to not + * use this filename directly. Preferably generate a unique one and save + * this one one somewhere for reference, if necessary. * @return the original filename, or the empty String if no file has been chosen * in the multipart form, or {@code null} if not defined or not available * @see org.apache.commons.fileupload.FileItem#getName() diff --git a/src/docs/asciidoc/web/webflux.adoc b/src/docs/asciidoc/web/webflux.adoc index 21818a7814..406df2a17d 100644 --- a/src/docs/asciidoc/web/webflux.adoc +++ b/src/docs/asciidoc/web/webflux.adoc @@ -3002,8 +3002,8 @@ for the body. This allows a variety of async responses with `ResponseEntity` as asynchronously at a later point. This allows the response status and headers to vary depending on the outcome of asynchronous request handling. * `Mono>>` or `Mono>>` are yet another - possible, albeit less common alternative. They provides the response status and headers - asynchronously first and then the response body, also asynchronously at a second point later. + possible, albeit less common alternative. They provide the response status and headers + asynchronously first and then the response body, also asynchronously, second. [[webflux-ann-jackson]]