alhudz opened a new pull request, #480:
URL: https://github.com/apache/commons-fileupload/pull/480
Port of #479 to the `1.x` branch, as requested there. The 1.x
`ParameterParser.parse` has the same pattern: an `IllegalArgumentException`
from the RFC 2231 decode sets `paramValue = null` and the parameter is still
stored, so a malformed `filename*` clobbers a valid `filename` after
`stripDelimiter`.
Repro: `parse("form-data; name=\"file\"; filename=\"safe.txt\";
filename*=UTF-8''bad%2", new char[]{',',';'})`. Expected: `filename` stays
`safe.txt`. Actual on unpatched 1.x: `filename` is `null` (the new test fails
with `expected: <safe.txt> but was: <null>`).
Same fix as #479, adapted to 1.x (no `var`): flag the invalid decode and
skip storing that parameter. Includes the same regression test; full 1.x suite
passes (87 tests) and checkstyle is clean.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
