This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-codec.git
The following commit(s) were added to refs/heads/master by this push:
new 3c0f4302 Reject embedded question marks in RFC 1522 encoded content
3c0f4302 is described below
commit 3c0f43025a029923cf0b34893459c6944e7e21b9
Author: Gary Gregory <[email protected]>
AuthorDate: Fri Sep 18 13:01:45 2026 -0700
Reject embedded question marks in RFC 1522 encoded content
Require the payload separator to be the final "?=" delimiter, preventing
BCodec and QCodec from silently discarding trailing content. Preserve
BCodec's lenient default decoding policy.
Add regression tests for malformed payloads under both BCodec policies
and for correctly encoded question marks.
---
.../org/apache/commons/codec/net/RFC1522Codec.java | 3 +++
.../java/org/apache/commons/codec/net/BCodecTest.java | 18 ++++++++++++++++++
.../java/org/apache/commons/codec/net/QCodecTest.java | 13 +++++++++++++
.../org/apache/commons/codec/net/RFC1522CodecTest.java | 3 +++
4 files changed, 37 insertions(+)
diff --git a/src/main/java/org/apache/commons/codec/net/RFC1522Codec.java
b/src/main/java/org/apache/commons/codec/net/RFC1522Codec.java
index 538e60a1..5ed59663 100644
--- a/src/main/java/org/apache/commons/codec/net/RFC1522Codec.java
+++ b/src/main/java/org/apache/commons/codec/net/RFC1522Codec.java
@@ -99,6 +99,9 @@ abstract class RFC1522Codec {
}
from = to + 1;
to = text.indexOf(SEP, from);
+ if (to != terminator) {
+ throw new DecoderException("RFC 1522 violation: '?' embedded in
the encoded content");
+ }
byte[] data = StringUtils.getBytesUsAscii(text.substring(from, to));
data = doDecoding(data);
return new String(data, charset);
diff --git a/src/test/java/org/apache/commons/codec/net/BCodecTest.java
b/src/test/java/org/apache/commons/codec/net/BCodecTest.java
index 1b85c1e1..57f0ccb9 100644
--- a/src/test/java/org/apache/commons/codec/net/BCodecTest.java
+++ b/src/test/java/org/apache/commons/codec/net/BCodecTest.java
@@ -99,6 +99,24 @@ class BCodecTest {
assertEquals(plain, bcodec.decode(encoded), "Basic B decoding test");
}
+ @Test
+ void testDecodeEmbeddedQuestionMark() {
+ for (final BCodec codec : new BCodec[] {new BCodec(), new
BCodec(StandardCharsets.UTF_8, CodecPolicy.LENIENT),
+ new BCodec(StandardCharsets.UTF_8, CodecPolicy.STRICT)}) {
+ for (final String encoded : new String[] {"=?UTF-8?B?QUJD?REVG?=",
"=?UTF-8?B?QQ==??=", "=?UTF-8?B???="}) {
+ assertThrows(DecoderException.class, () ->
codec.decode(encoded), encoded);
+ }
+ }
+ }
+
+ @Test
+ void testDecodeEncodedQuestionMark() throws DecoderException {
+ for (final CodecPolicy policy : CodecPolicy.values()) {
+ final BCodec codec = new BCodec(StandardCharsets.UTF_8, policy);
+ assertEquals("ABC?DEF", codec.decode("=?UTF-8?B?QUJDP0RFRg==?="));
+ }
+ }
+
@Test
void testDecodeObjects() throws Exception {
final BCodec bcodec = new BCodec();
diff --git a/src/test/java/org/apache/commons/codec/net/QCodecTest.java
b/src/test/java/org/apache/commons/codec/net/QCodecTest.java
index 95886e5e..ea17fade 100644
--- a/src/test/java/org/apache/commons/codec/net/QCodecTest.java
+++ b/src/test/java/org/apache/commons/codec/net/QCodecTest.java
@@ -58,6 +58,19 @@ class QCodecTest {
assertEquals(plain, qcodec.decode(encoded), "Basic Q decoding test");
}
+ @Test
+ void testDecodeEmbeddedQuestionMark() {
+ final QCodec codec = new QCodec();
+ for (final String encoded : new String[] {"=?UTF-8?Q?ABC?DEF?=",
"=?UTF-8?Q?ABC??=", "=?UTF-8?Q???="}) {
+ assertThrows(DecoderException.class, () -> codec.decode(encoded),
encoded);
+ }
+ }
+
+ @Test
+ void testDecodeEncodedQuestionMark() throws DecoderException {
+ assertEquals("ABC?DEF", new QCodec().decode("=?UTF-8?Q?ABC=3FDEF?="));
+ }
+
@Test
void testDecodeObjects() throws Exception {
final QCodec qcodec = new QCodec();
diff --git a/src/test/java/org/apache/commons/codec/net/RFC1522CodecTest.java
b/src/test/java/org/apache/commons/codec/net/RFC1522CodecTest.java
index 191fa811..82137a23 100644
--- a/src/test/java/org/apache/commons/codec/net/RFC1522CodecTest.java
+++ b/src/test/java/org/apache/commons/codec/net/RFC1522CodecTest.java
@@ -72,6 +72,9 @@ class RFC1522CodecTest {
assertExpectedDecoderException("=??T?stuff?=");
assertExpectedDecoderException("=?UTF-8??stuff?=");
assertExpectedDecoderException("=?UTF-8?W?stuff?=");
+ assertExpectedDecoderException("=?UTF-8?T?stuff?more?=");
+ assertExpectedDecoderException("=?UTF-8?T?stuff??=");
+ assertExpectedDecoderException("=?UTF-8?T???=");
}
@Test
