exceptionfactory commented on code in PR #11560:
URL: https://github.com/apache/nifi/pull/11560#discussion_r3810041895
##########
nifi-registry/nifi-registry-core/nifi-registry-client/src/main/java/org/apache/nifi/registry/client/impl/ClientUtils.java:
##########
@@ -44,4 +45,38 @@ public static File getExtensionBundleVersionContent(final
Response response, fin
}
}
+ private static File getContentDispositionFile(final String
contentDispositionHeader, final File outputDirectory) {
+ if (contentDispositionHeader.indexOf('\\') >= 0) {
Review Comment:
It would be helpful to declare this character and others as static member
variables
##########
nifi-toolkit/nifi-toolkit-client/src/main/java/org/apache/nifi/toolkit/client/impl/AbstractJerseyClient.java:
##########
@@ -139,18 +143,41 @@ protected String getContentDispositionFilename(final
Response response) {
if (StringUtils.isBlank(contentDispositionHeader)) {
throw new IllegalStateException("Content-Disposition header was
blank or missing");
}
+ if (contentDispositionHeader.indexOf('\\') >= 0) {
+ throw new IllegalStateException("Content-Disposition filename was
invalid");
+ }
+
+ final String filename;
+ try {
+ final String normalizedHeader =
contentDispositionHeader.replaceFirst("(?i);\\s*filename\\s*=\\s*", ";
filename=");
Review Comment:
See similar notes regarding regular expression pattern and character
variables
##########
nifi-registry/nifi-registry-core/nifi-registry-client/src/main/java/org/apache/nifi/registry/client/impl/ClientUtils.java:
##########
@@ -44,4 +45,38 @@ public static File getExtensionBundleVersionContent(final
Response response, fin
}
}
+ private static File getContentDispositionFile(final String
contentDispositionHeader, final File outputDirectory) {
+ if (contentDispositionHeader.indexOf('\\') >= 0) {
+ throw new IllegalStateException("Content-Disposition filename was
invalid");
+ }
+
+ final String filename;
+ try {
+ final String normalizedHeader =
contentDispositionHeader.replaceFirst("(?i);\\s*filename\\s*=\\s*", ";
filename=");
Review Comment:
I recommend declaring the regular expression pattern as a static member
variable and using matching instead of the String method
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
