(commons-fileupload) branch master updated: Reject malformed base64 payload in RFC 2047 decodeWord (#478)

[ggregory]

This is an automated email from the ASF dual-hosted git repository.

garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-fileupload.git


The following commit(s) were added to refs/heads/master by this push:
     new d4927998 Reject malformed base64 payload in RFC 2047 decodeWord (#478)
d4927998 is described below

commit d492799856fc774262660033fca8f8bc9351f18e
Author: alhuda <50839256+alh...@users.noreply.github.com>
AuthorDate: Wed Jul 15 23:55:58 2026 +0530

    Reject malformed base64 payload in RFC 2047 decodeWord (#478)
---
 .../main/java/org/apache/commons/fileupload2/core/MimeUtils.java   | 4 +++-
 .../org/apache/commons/fileupload2/core/MimeUtilityTestCase.java   | 7 +++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git 
a/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/MimeUtils.java
 
b/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/MimeUtils.java
index 0cd0e847..0ab0a50f 100644
--- 
a/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/MimeUtils.java
+++ 
b/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/MimeUtils.java
@@ -235,7 +235,9 @@ final class MimeUtils {
             // get the decoded byte data and convert into a string.
             final var decodedData = out.toByteArray();
             return new String(decodedData, javaCharset(charset));
-        } catch (final IOException e) {
+        } catch (final IOException | IllegalArgumentException e) {
+            // IllegalArgumentException is thrown by the Base64 decoder on a 
malformed final unit; treat it like a
+            // quoted-printable decode failure so both encodings reject 
malformed input the same way.
             throw new UnsupportedEncodingException("Invalid RFC 2047 
encoding");
         }
     }
diff --git 
a/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/MimeUtilityTestCase.java
 
b/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/MimeUtilityTestCase.java
index 62867c5d..e6176e82 100644
--- 
a/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/MimeUtilityTestCase.java
+++ 
b/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/MimeUtilityTestCase.java
@@ -32,6 +32,13 @@ public final class MimeUtilityTestCase {
         assertEquals(expected, MimeUtils.decodeText(encoded));
     }
 
+    @Test
+    void testDecodeInvalidBase64() {
+        // A base64 payload whose final unit is truncated ("A" is a single 
base64 char) is rejected the same way as a
+        // malformed quoted-printable payload, rather than leaking an 
IllegalArgumentException from the base64 decoder.
+        assertThrows(UnsupportedEncodingException.class, () -> 
MimeUtils.decodeText("=?UTF-8?B?A?="));
+    }
+
     @Test
     void testDecodeInvalidEncoding() {
         assertThrows(UnsupportedEncodingException.class, () -> 
MimeUtils.decodeText("=?invalid?B?xyz-?="));