alhudz opened a new pull request, #478:
URL: https://github.com/apache/commons-fileupload/pull/478
`MimeUtils.decodeWord` decodes an RFC 2047 encoded-word reached from a
`Content-Disposition` / `Content-Type` parameter (`filename`, `name`,
`boundary`) via `ParameterParser`. The base64 branch calls
`Base64.getMimeDecoder().decode(...)`, which throws `IllegalArgumentException`
on a malformed final unit. That is not caught by the surrounding `catch
(IOException)`, so it escapes the method's declared `throws ParseException,
UnsupportedEncodingException`. The quoted-printable branch throws `IOException`
on the same kind of malformed input and is remapped cleanly, so the two
encodings reject bad input inconsistently.
Repro: `MimeUtils.decodeText("=?UTF-8?B?A?=")` (payload is a single base64
char).
Expected: `UnsupportedEncodingException`, as for a malformed `Q` payload.
Actual: `IllegalArgumentException` ("Last unit does not have enough valid
bits").
Widen the existing catch to `IOException | IllegalArgumentException` so a
malformed base64 payload is rejected like a malformed quoted-printable one.
Keeping the mapping in `decodeWord` keeps both encodings within the same
declared contract instead of leaking a base64-specific runtime exception.
Covered by a new case in `MimeUtilityTestCase`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
