This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch 3.6.x-fixes in repository https://gitbox.apache.org/repos/asf/cxf.git
commit aafd486d2955f43b3ca270b19b43b63e558a4719 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Mon Sep 7 15:28:22 2026 +0100 Harden Content-Disposition filename parsing against ReDoS (#3448) (cherry picked from commit 6d2b4231868979e12e68c4825d592e4c395d08ae) --- .../apache/cxf/attachment/ContentDisposition.java | 3 +- .../cxf/attachment/ContentDispositionTest.java | 48 ++++++++++++++++++++++ 2 files changed, 50 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/org/apache/cxf/attachment/ContentDisposition.java b/core/src/main/java/org/apache/cxf/attachment/ContentDisposition.java index a6ae0f2b0a5..44a2d710270 100644 --- a/core/src/main/java/org/apache/cxf/attachment/ContentDisposition.java +++ b/core/src/main/java/org/apache/cxf/attachment/ContentDisposition.java @@ -32,8 +32,9 @@ public class ContentDisposition { private static final Pattern CD_HEADER_PARAMS_PATTERN = Pattern.compile(CD_HEADER_PARAMS_EXPRESSION); + // Keep the alternatives disjoint and prevent backtracking over the encoded value. private static final String CD_HEADER_EXT_PARAMS_EXPRESSION = - "(?i)(UTF-8|ISO-8859-1)''((?:%[0-9a-f]{2}|\\S)+)"; + "(?i)(UTF-8|ISO-8859-1)''((?:%[0-9a-f]{2}|[^%\\s])++)"; private static final Pattern CD_HEADER_EXT_PARAMS_PATTERN = Pattern.compile(CD_HEADER_EXT_PARAMS_EXPRESSION); private static final Pattern CODEPOINT_ENCODED_VALUE_PATTERN = Pattern.compile("&#[0-9]{4};|\\S"); diff --git a/core/src/test/java/org/apache/cxf/attachment/ContentDispositionTest.java b/core/src/test/java/org/apache/cxf/attachment/ContentDispositionTest.java new file mode 100644 index 00000000000..45f503dac19 --- /dev/null +++ b/core/src/test/java/org/apache/cxf/attachment/ContentDispositionTest.java @@ -0,0 +1,48 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.cxf.attachment; + +import org.junit.Test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNull; + +public class ContentDispositionTest { + + @Test + public void testExtendedFilenameIsDecoded() { + ContentDisposition cd = new ContentDisposition("attachment;filename*=UTF-8''a%20file.txt"); + assertEquals("attachment", cd.getType()); + assertEquals("a file.txt", cd.getFilename()); + } + + @Test(timeout = 10000) + public void testMalformedExtendedFilenameDoesNotOverflow() { + StringBuilder value = new StringBuilder("attachment;filename*=UTF-8''"); + for (int i = 0; i < 2000; i++) { + value.append("%41"); + } + value.append(" x"); + + ContentDisposition cd = new ContentDisposition(value.toString()); + + assertNull(cd.getFilename()); + } +} \ No newline at end of file
