(commons-fileupload) branch master updated: Reject truncated percent-encoding in RFC2231Utils.decodeText (#475)

[ggregory]

This is an automated email from the ASF dual-hosted git repository.

garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-fileupload.git


The following commit(s) were added to refs/heads/master by this push:
     new 3e28315e Reject truncated percent-encoding in RFC2231Utils.decodeText 
(#475)
3e28315e is described below

commit 3e28315e364184e82bf03a8e07e50edff148abbc
Author: alhuda <50839256+alh...@users.noreply.github.com>
AuthorDate: Sun Jul 12 03:47:02 2026 +0530

    Reject truncated percent-encoding in RFC2231Utils.decodeText (#475)
---
 .../main/java/org/apache/commons/fileupload2/core/RFC2231Utils.java | 3 ++-
 .../org/apache/commons/fileupload2/core/RFC2231UtilityTestCase.java | 6 ++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git 
a/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/RFC2231Utils.java
 
b/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/RFC2231Utils.java
index 73f415cb..3d8c9da0 100644
--- 
a/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/RFC2231Utils.java
+++ 
b/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/RFC2231Utils.java
@@ -130,7 +130,8 @@ final class RFC2231Utils {
             final var c = text.charAt(i++);
             if (c == '%') {
                 if (i > text.length() - 2) {
-                    break; // unterminated sequence
+                    // A '%' that is not followed by two hex digits is a 
truncated escape sequence.
+                    throw new IllegalArgumentException();
                 }
                 final var c1 = text.charAt(i++);
                 final var c2 = text.charAt(i++);
diff --git 
a/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/RFC2231UtilityTestCase.java
 
b/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/RFC2231UtilityTestCase.java
index bd04552f..7e970f43 100644
--- 
a/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/RFC2231UtilityTestCase.java
+++ 
b/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/RFC2231UtilityTestCase.java
@@ -51,6 +51,12 @@ public final class RFC2231UtilityTestCase {
         assertThrows(IllegalArgumentException.class, () -> 
RFC2231Utils.decodeText("ISO-8859-1''hello%3\u8a35"));
     }
 
+    @Test
+    void testDecodeTruncatedPercentEncoded() throws Exception {
+        assertThrows(IllegalArgumentException.class, () -> 
RFC2231Utils.decodeText("ISO-8859-1''hello%"));
+        assertThrows(IllegalArgumentException.class, () -> 
RFC2231Utils.decodeText("ISO-8859-1''hello%3"));
+    }
+
     @Test
     void testDecodeIso88591() throws Exception {
         assertEncoded("\u00A3 rate", "iso-8859-1'en'%A3%20rate"); // "£ rate"