Issue Summary

Multipart file uploads including files with a filename which is invalid on Windows (e.g. 'file?name.txt') will be rejected by a Confluence instance hosted on Windows.

This bug impacts Struts Actions, REST APIs and any other code paths utilising the commons-fileupload2 dependency.

This includes but is not limited to the following endpoints:

• /pages/doattachfile.action?pageId={pageId}
• /rest/api/content/{pageId}/child/attachment/{attachmentId}/data

Steps to Reproduce

1. Login to a Confluence instance running on Windows from a Unix computer
2. Navigate to any Confluence page
3. Open the Attachments panel from the page menu
4. Attempt to upload a file with an illegal character, e.g. file?name.txt

Expected Results

Successful upload

Actual Results

Upload error shown

(In the case of a REST API request: 400 Bad request - Illegal char)

Workaround

Users should rename file(s) to remove characters which are illegal on a Windows filesystem and retry upload or form submission.