Why is cffile.serverFileExt sometimes null, sometimes empty string?

JayTennant · October 24, 2026, 1:33pm

I noticed that the FileTag in Lucee will return a null for an uploaded file’s extension if the extension is empty in the field: cffile.serverFileExt.

However, if the file is renamed due to “forceUnique” or “makeUnique” (on naming conflict), then the field is an empty string.

A little bit differently, an empty client file extension will always make an empty string in the field: cffile.clientFileExt.

I ran into this issue because some legacy code incorrectly assumed an extension always existed, and when referring to cffile.serverFileExt it would crash when an uploaded file did not have an extension. So this actually helped me clean up the code, but I don’t understand why the source is written this way. Is it a bug, or legacy support, or something else?

Line 1013 is the place in the source where it is set to null, whereas 1024 is one example where it is set to an empty string:

github.com

lucee/Lucee/blob/990b0cc2bdf2686def7e626346b9592464eaa264/core/src/main/java/lucee/runtime/tag/FileTag.java#L1011-L1026


      
          		cffile.set(KeyConstants._serverdirectory, getParent(destination));
          		cffile.set(KeyConstants._serverfile, destination.getName());
          		cffile.set(KeyConstants._serverfileext, ResourceUtil.getExtension(destination, null));
          		cffile.set(KeyConstants._serverfilename, ResourceUtil.getName(destination));
          		cffile.set(KeyConstants._attemptedserverfile, destination.getName());
          
          		// check nameconflict
          		if (nameconflict == NAMECONFLICT_FORCEUNIQUE) {
          			destination = forceUnique(destination);
          			fileWasRenamed = true;
          
          			cffile.set(KeyConstants._serverdirectory, getParent(destination));
          			cffile.set(KeyConstants._serverfile, destination.getName());
          			cffile.set(KeyConstants._serverfileext, ResourceUtil.getExtension(destination, ""));
          			cffile.set(KeyConstants._serverfilename, ResourceUtil.getName(destination));
          		}

In contrast, the clientFileExt is always set to an empty string if it is not present on the original file indicated by the client (line 978):

github.com

lucee/Lucee/blob/990b0cc2bdf2686def7e626346b9592464eaa264/core/src/main/java/lucee/runtime/tag/FileTag.java#L978


      
          		else contentType = formItem.getContentType();
          
          		cffile.set(KeyConstants._contenttype, ListFirst.call(pageContext, contentType, "/", false, 1));
          		cffile.set(KeyConstants._contentsubtype, ListLast.call(pageContext, contentType, "/", false, 1));
          
          		// check file type
          		checkContentType(contentType, accept, allowedExtensions, blockedExtensions, clientFile, strict, pageContext.getApplicationContext());
          
          		cffile.set(KeyConstants._clientdirectory, getParent(clientFile));
          		cffile.set(KeyConstants._clientfile, clientFile.getName());
          		cffile.set(KeyConstants._clientfileext, ResourceUtil.getExtension(clientFile, ""));
          		cffile.set(KeyConstants._clientfilename, ResourceUtil.getName(clientFile));
          
          		// check destination
          		if (StringUtil.isEmpty(strDestination)) throw new ApplicationException("Attribute [destination] is required for tag [file], when action is [" + actionValue + "]");
          
          		Resource destination = toDestination(pageContext, strDestination, null);
          		securityManager.checkFileLocation(pageContext.getConfig(), destination, serverPassword);
          
          		if (destination.isDirectory()) destination = destination.getRealResource(clientFileName);
          		else if (!destination.exists() && (strDestination.endsWith("/") || strDestination.endsWith("\\"))) destination = destination.getRealResource(clientFileName);

GianTschingt · October 24, 2026, 9:49pm

Thanks for digging into the source, Jay. That’s a bug, not legacy behaviour. In the normal upload path the server extension is set with a null default, while clientFileExt (and the makeUnique/forceUnique code) use an empty string. So a file without an extension ends up with serverFileExt = null, and without full null support reading it then fails. It should be an empty string. I filed LDEV-6718 and the fix for 7.1 is up for review. Until then, cffile.serverFileExt ?: "" (or checking structKeyExists) avoids the crash.

JayTennant · October 26, 2026, 10:54am

Thanks for the quick reply and upcoming fix! Would this fix also apply for Lucee 6? I hadn’t mentioned but our codebase uses Lucee 6.2, and we haven’t evaluated the impact in going to Lucee 7 yet.

I am using a workaround, though, so our project will not be affected either way. I’m just asking for other Lucee 6 projects that could benefit from the fix.

GianTschingt · October 27, 2026, 9:52am

The LDEV-6718 fix is on 7.1 only; we’re not backporting it to 6.2. Your workaround is the way to go there, and the fix is included once you move to 7.1.

Also good to know: we’ll soon make Lucee 7.1 the LTS version, and after that 6.2 will reach end of life as well. We’re here to help you sort out any issues along the way.