A valid point but in this case the file picker is triggered by a JS script
<html lang="en">
<head>
<title>KDE485</title>
<meta http-equiv=Content-Type content="text/html; charset=utf-8">
</head>
<body>
<h2>Upload file</h2>
<input type="file" id="file">
<input type="submit" value="Upload" id="submit">
<a href="/files.html"><button>Cancel</button></a>
<div id="progress">Please select a file to upload and then click Upload</div>
<script>
function updateProgress(evt)
{
if (evt.lengthComputable)
{
document.getElementById("progress").innerHTML = evt.loaded " of " evt.total ", " (evt.loaded/evt.total*100).toFixed(1) "%";
}
}
function uploadFile()
{
const fileInput = document.getElementById('file');
if(fileInput.files.length == 0) {
alert("Select a file to upload first");
return;
}
document.getElementById("submit").disabled = true;
const fileReader = new FileReader();
fileReader.addEventListener("load", function (e) {
const rawData = e.target.result;
const putRequest = new XMLHttpRequest();
putRequest.open("PUT", "/ufile=" fileInput.files[0].name);
putRequest.upload.addEventListener("progress", updateProgress, false);
putRequest.addEventListener("load", function (f) {
if(putRequest.status == 200 || putRequest.status == 201) {
document.getElementById("progress").innerHTML = '';
alert("Upload succeeded");
history.back();
} else {
alert("Upload failed with code " putRequest.status);
document.getElementById("progress").innerHTML = 'Upload failed.';
document.getElementById("submit").disabled = false;
}
});
putRequest.send(rawData);
});
fileReader.readAsArrayBuffer(fileInput.files[0]);
}
document.getElementById("submit").addEventListener("click", uploadFile);
</script>
</body>
</html>
So it should be the standard file picker for the OS in question, capable of selecting any file, and I have no control over anything. Actually the JS could be modified to do the 8.3 check.
I haven't actually tested the above code yet :)
Of course, as with any client-side stuff, this is easily hacked, but there is only so much I want to do in what is supposed to be a controlled environment (this http server will be specified as never to be on an open port, etc, in case the customer is a complete idiot).
EDIT: I have found that passing an invalid-8.3 filename to FatFS does fail upon opening the file. Tracing the code shows they do the various obvious checks for size, invalid chars, etc. Pretty good!