views:

748

answers:

2

Is there a maximum lengh for a file extension? The longest one I've seen is .compiled (8 chars)

Useless Background

I'm creating a IHttpHandler to return image icons for a specific filename. I'm simply calling a FileImage.axd?ext=pptx. I'm generating the files on the fly using SHGetFileInfo similar to my post for WPF, then caching them locally in a folder with the filename 'pptx.png'. I'd like to validate the length and trim it to prevent a DoS type attack where someone would try to generate images for and infinite number of junk characters (eg FileImage.axd?ext=asdfasdfweqrsadfasdfwqe...).

+3  A: 

As far as I know, there is no limit, except the maximum length of the file name. Extension is not treated specially except in FAT16.

Arkadiy
Thanks this unfortunately doesn't give me a solution. I guess I'll just limit it to 10. The images are going to be loaded from the webserver, so i wonder what the longest extension on a stardard build of IIS webserver would be.
bendewey
The solution is - write your code so that it can work with any extension size, avoid C Programmer's Disease.
Arkadiy
A: 

I agree with Arkadiy - there is no formal limit now that the DOS 8.3 system is a thing of the past (or other similar, limited systems). I would say that the majority of the extensions I've seen are in the range 1-3; Java uses 4 for .java and 5 for .class. Your example with 8 is longer than I recall. If I were scoping, I'd aim for 'unlimited'; if that's not feasible, allow at least 16 characters - with the confident expectation that in fact 16 would be quite sufficient for current systems.

Jonathan Leffler
If this is ever applied in Unix environment, files like .profile may have names longer than 16, and of course the entire name is an extension :)
Arkadiy
I guess that depends on your definition of extension. I wouldn't count it as an extension unless there is something before the dot, but the alternative viewpoint is also logically tenable. Also, those extensions are all unique - you can't have 16 files all called .profile in a single directory.
Jonathan Leffler