(commons-fileupload) branch 1.x updated: Reject truncated percent-encoding in RFC2231Utility.decodeText (#477)

[ggregory]

This is an automated email from the ASF dual-hosted git repository.

garydgregory pushed a commit to branch 1.x
in repository https://gitbox.apache.org/repos/asf/commons-fileupload.git


The following commit(s) were added to refs/heads/1.x by this push:
     new 51e79ab0 Reject truncated percent-encoding in 
RFC2231Utility.decodeText (#477)
51e79ab0 is described below

commit 51e79ab035f6aa1ec5ecff43baab903eef8c3212
Author: alhuda <50839256+alh...@users.noreply.github.com>
AuthorDate: Mon Jul 13 20:21:27 2026 +0530

    Reject truncated percent-encoding in RFC2231Utility.decodeText (#477)
---
 src/main/java/org/apache/commons/fileupload/RFC2231Utility.java    | 3 ++-
 .../java/org/apache/commons/fileupload/RFC2231UtilityTestCase.java | 7 +++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/apache/commons/fileupload/RFC2231Utility.java 
b/src/main/java/org/apache/commons/fileupload/RFC2231Utility.java
index 10e7a095..b7c756ca 100644
--- a/src/main/java/org/apache/commons/fileupload/RFC2231Utility.java
+++ b/src/main/java/org/apache/commons/fileupload/RFC2231Utility.java
@@ -139,7 +139,8 @@ final class RFC2231Utility {
             final char c = text.charAt(i++);
             if (c == PERCENT) {
                 if (i > text.length() - 2) {
-                    break; // unterminated sequence
+                    // A '%' that is not followed by two hex digits is a 
truncated escape sequence.
+                    throw new IllegalArgumentException();
                 }
                 final char c1 = text.charAt(i++);
                 final char c2 = text.charAt(i++);
diff --git 
a/src/test/java/org/apache/commons/fileupload/RFC2231UtilityTestCase.java 
b/src/test/java/org/apache/commons/fileupload/RFC2231UtilityTestCase.java
index 7733dd85..2645d573 100644
--- a/src/test/java/org/apache/commons/fileupload/RFC2231UtilityTestCase.java
+++ b/src/test/java/org/apache/commons/fileupload/RFC2231UtilityTestCase.java
@@ -75,6 +75,13 @@ public final class RFC2231UtilityTestCase {
     }
 
 
+    @Test
+    void testDecodeTruncatedPercentEncoded() throws Exception {
+        assertThrows(IllegalArgumentException.class, () -> 
RFC2231Utility.decodeText("ISO-8859-1''hello%"));
+        assertThrows(IllegalArgumentException.class, () -> 
RFC2231Utility.decodeText("ISO-8859-1''hello%3"));
+    }
+
+
     @Test
     void testDecodeUTF8Characters() throws Exception {
         assertThrows(IllegalArgumentException.class, () -> 
RFC2231Utility.decodeText("UTF-8''\\u8a2e"));