This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/main by this push:
new 6d2b4231868 Harden Content-Disposition filename parsing against ReDoS
(#3448)
6d2b4231868 is described below
commit 6d2b4231868979e12e68c4825d592e4c395d08ae
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Mon Sep 7 15:28:22 2026 +0100
Harden Content-Disposition filename parsing against ReDoS (#3448)
---
.../apache/cxf/attachment/ContentDisposition.java | 3 +-
.../cxf/attachment/ContentDispositionTest.java | 48 ++++++++++++++++++++++
2 files changed, 50 insertions(+), 1 deletion(-)
diff --git
a/core/src/main/java/org/apache/cxf/attachment/ContentDisposition.java
b/core/src/main/java/org/apache/cxf/attachment/ContentDisposition.java
index a6ae0f2b0a5..44a2d710270 100644
--- a/core/src/main/java/org/apache/cxf/attachment/ContentDisposition.java
+++ b/core/src/main/java/org/apache/cxf/attachment/ContentDisposition.java
@@ -32,8 +32,9 @@ public class ContentDisposition {
private static final Pattern CD_HEADER_PARAMS_PATTERN =
Pattern.compile(CD_HEADER_PARAMS_EXPRESSION);
+ // Keep the alternatives disjoint and prevent backtracking over the
encoded value.
private static final String CD_HEADER_EXT_PARAMS_EXPRESSION =
- "(?i)(UTF-8|ISO-8859-1)''((?:%[0-9a-f]{2}|\\S)+)";
+ "(?i)(UTF-8|ISO-8859-1)''((?:%[0-9a-f]{2}|[^%\\s])++)";
private static final Pattern CD_HEADER_EXT_PARAMS_PATTERN =
Pattern.compile(CD_HEADER_EXT_PARAMS_EXPRESSION);
private static final Pattern CODEPOINT_ENCODED_VALUE_PATTERN =
Pattern.compile("&#[0-9]{4};|\\S");
diff --git
a/core/src/test/java/org/apache/cxf/attachment/ContentDispositionTest.java
b/core/src/test/java/org/apache/cxf/attachment/ContentDispositionTest.java
new file mode 100644
index 00000000000..45f503dac19
--- /dev/null
+++ b/core/src/test/java/org/apache/cxf/attachment/ContentDispositionTest.java
@@ -0,0 +1,48 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.attachment;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+
+public class ContentDispositionTest {
+
+ @Test
+ public void testExtendedFilenameIsDecoded() {
+ ContentDisposition cd = new
ContentDisposition("attachment;filename*=UTF-8''a%20file.txt");
+ assertEquals("attachment", cd.getType());
+ assertEquals("a file.txt", cd.getFilename());
+ }
+
+ @Test(timeout = 10000)
+ public void testMalformedExtendedFilenameDoesNotOverflow() {
+ StringBuilder value = new
StringBuilder("attachment;filename*=UTF-8''");
+ for (int i = 0; i < 2000; i++) {
+ value.append("%41");
+ }
+ value.append(" x");
+
+ ContentDisposition cd = new ContentDisposition(value.toString());
+
+ assertNull(cd.getFilename());
+ }
+}
\ No newline at end of file
