[jira] [Commented] (WW-5413) Multipart misbehavior with commons-io 2.16.0 and 2.16.1
[ https://issues.apache.org/jira/browse/WW-5413?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17851830#comment-17851830 ] Riccardo Proserpio commented on WW-5413: It might be, yes > Multipart misbehavior with commons-io 2.16.0 and 2.16.1 > --- > > Key: WW-5413 > URL: https://issues.apache.org/jira/browse/WW-5413 > Project: Struts 2 > Issue Type: Bug > Components: Core >Affects Versions: 6.3.0 >Reporter: Riccardo Proserpio >Priority: Major > Fix For: 6.5.0 > > > commons-io 2.16.0 has broken the implementation of > DeferredFileOutputStream changing the behavior of its superclass > ThresholdingOutputStream: IO-854 > > The class is used by commons-fileupload DiskFileItem, that is used by Struts > to handle multipart uploads. The issue causes each multipart part to be read > as empty. > > A fix has been implemented in 2.16.1. However, the fix exposes an issue in > how the getFile of JakartaMultiPartRequest uses DiskFileItem, that causes it > to mishandle zero length inputs. > > The issue is related to WW-5088 and WW-5146 > > Moreover, the fix implemented for this issues seems to be dubious and affects > not only file uploads but every field encoded as multipart/form-data: by > forcing the diskfileitem threshold to be -1, each and every field was written > to the filesystem. > > The behavior of threadshold -1 was underspecified and inconsistent with the > commons-io implementation, and has been specified in 2.16.1. > > To really fix the issue, I suggest to avoid specifying -1 on the > DiskFileItemFactory and to properly handle the case when the > DiskFileItem.isInMemory() returns true in the JakartaMultiPartRequest.getFile > method: in this case getStoreLocation() is defined to return null and the > bytes should be read from memory instead. > > Avoiding always spilling to disk each and every multipart part should also be > a performance win, considering that multipart can also be used to transfer > normal form inputs and not only files. > > What do you think? -- This message was sent by Atlassian Jira (v8.20.10#820010)
[jira] [Commented] (WW-5423) Query Parameters in Multipart Requests not working in v7 M6
[
https://issues.apache.org/jira/browse/WW-5423?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17851630#comment-17851630
]
Lukasz Lenart commented on WW-5423:
---
>From the other side {{HttpServletRequest#getParameterValues(String)}} returns
>{{null}} if parameter doesn't exist so maybe it's better to keep the old
>behaviour to be aligned with Servlet spec
> Query Parameters in Multipart Requests not working in v7 M6
> ---
>
> Key: WW-5423
> URL: https://issues.apache.org/jira/browse/WW-5423
> Project: Struts 2
> Issue Type: Bug
>Affects Versions: 7.0.0
>Reporter: Philip Crider
>Priority: Major
> Fix For: 7.0.0
>
>
> One of the changes in [https://github.com/apache/struts/pull/861] broke query
> parameters in multipart requests. Their values are being lost.
> This is the old implementation, which returns null if the parameter doesn't
> exist.
> {code:java}
> public String[] getParameterValues(String name) {
> List v = params.get(name);
> if (v != null && !v.isEmpty()) {
> return v.toArray(new String[0]);
> }
> return null;
> } {code}
>
> And this is the new implementation, which returns an empty array in that case.
> {code:java}
> public String[] getParameterValues(String name) {
> return parameters.getOrDefault(name, Collections.emptyList())
> .toArray(String[]::new);
> }{code}
>
> This method in MultiPartRequestWrapper is expecting null to be returned in
> that case.
> {code:java}
> public String[] getParameterValues(String name) {
> return ((multi == null) || (multi.getParameterValues(name) == null)) ?
> super.getParameterValues(name) : multi.getParameterValues(name);
> }{code}
>
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
[jira] [Commented] (WW-5423) Query Parameters in Multipart Requests not working in v7 M6
[
https://issues.apache.org/jira/browse/WW-5423?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17851624#comment-17851624
]
Philip Crider commented on WW-5423:
---
That seems like a good change to me, and would definitely fix the problem.
> Query Parameters in Multipart Requests not working in v7 M6
> ---
>
> Key: WW-5423
> URL: https://issues.apache.org/jira/browse/WW-5423
> Project: Struts 2
> Issue Type: Bug
>Affects Versions: 7.0.0
>Reporter: Philip Crider
>Priority: Major
> Fix For: 7.0.0
>
>
> One of the changes in [https://github.com/apache/struts/pull/861] broke query
> parameters in multipart requests. Their values are being lost.
> This is the old implementation, which returns null if the parameter doesn't
> exist.
> {code:java}
> public String[] getParameterValues(String name) {
> List v = params.get(name);
> if (v != null && !v.isEmpty()) {
> return v.toArray(new String[0]);
> }
> return null;
> } {code}
>
> And this is the new implementation, which returns an empty array in that case.
> {code:java}
> public String[] getParameterValues(String name) {
> return parameters.getOrDefault(name, Collections.emptyList())
> .toArray(String[]::new);
> }{code}
>
> This method in MultiPartRequestWrapper is expecting null to be returned in
> that case.
> {code:java}
> public String[] getParameterValues(String name) {
> return ((multi == null) || (multi.getParameterValues(name) == null)) ?
> super.getParameterValues(name) : multi.getParameterValues(name);
> }{code}
>
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
