You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by ma...@apache.org on 2025/09/02 07:02:40 UTC
(commons-fileupload) branch master updated: Better exception if a multipart/mixed part has no boundary token defined
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-fileupload.git
The following commit(s) were added to refs/heads/master by this push:
new 80a46e62 Better exception if a multipart/mixed part has no boundary token defined
80a46e62 is described below
commit 80a46e62ff3c51ead750dc7afce4c94156924b4f
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Tue Sep 2 08:02:34 2025 +0100
Better exception if a multipart/mixed part has no boundary token defined
---
.../core/FileItemInputIteratorImpl.java | 4 +++
.../fileupload2/core/AbstractFileUploadTest.java | 37 ++++++++++++++++++++++
src/changes/changes.xml | 1 +
3 files changed, 42 insertions(+)
diff --git a/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/FileItemInputIteratorImpl.java b/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/FileItemInputIteratorImpl.java
index 3815baa8..f35c2fbb 100644
--- a/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/FileItemInputIteratorImpl.java
+++ b/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/FileItemInputIteratorImpl.java
@@ -23,6 +23,7 @@ import java.util.Locale;
import java.util.NoSuchElementException;
import java.util.Objects;
+import org.apache.commons.fileupload2.core.MultipartInput.FileUploadBoundaryException;
import org.apache.commons.io.Charsets;
import org.apache.commons.io.IOUtils;
import org.apache.commons.io.input.BoundedInputStream;
@@ -171,6 +172,9 @@ class FileItemInputIteratorImpl implements FileItemInputIterator {
currentFieldName = fieldName;
// Multiple files associated with this field name
final var subBoundary = fileUpload.getBoundary(subContentType);
+ if (subBoundary == null) {
+ throw new FileUploadBoundaryException("The request was rejected because no boundary token was defined for a multipart/mixed part");
+ }
multi.setBoundary(subBoundary);
skipPreamble = true;
continue;
diff --git a/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/AbstractFileUploadTest.java b/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/AbstractFileUploadTest.java
index 14c55def..f3b85c25 100644
--- a/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/AbstractFileUploadTest.java
+++ b/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/AbstractFileUploadTest.java
@@ -19,6 +19,7 @@ package org.apache.commons.fileupload2.core;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
import java.io.IOException;
@@ -26,6 +27,8 @@ import java.nio.charset.StandardCharsets;
import org.junit.jupiter.api.Test;
+import org.apache.commons.fileupload2.core.MultipartInput.FileUploadBoundaryException;
+
/**
* Common tests for implementations of {@link AbstractFileUpload}. This is a parameterized test. Tests must be valid and common to all implementations of
* FileUpload added as parameter in this class.
@@ -394,6 +397,40 @@ public abstract class AbstractFileUploadTest<AFU extends AbstractFileUpload<R, I
assertEquals("fieldValue2", field2.getString());
}
+ /**
+ * Test for multipart/mixed with no boundary defined
+ */
+ @Test
+ void testMultipartMixedNoBoundary() {
+ // @formatter:off
+ final var contentType = "multipart/form-data; boundary=AaB03x";
+ final var request =
+ "--AaB03x\r\n" +
+ "content-disposition: form-data; name=\"field1\"\r\n" +
+ "\r\n" +
+ "Joe Blow\r\n" +
+ "--AaB03x\r\n" +
+ "content-disposition: form-data; name=\"pics\"\r\n" +
+ "Content-type: multipart/mixed\r\n" +
+ "\r\n" +
+ "--BbC04y\r\n" +
+ "Content-disposition: attachment; filename=\"file1.txt\"\r\n" +
+ "Content-Type: text/plain\r\n" +
+ "\r\n" +
+ "... contents of file1.txt ...\r\n" +
+ "--BbC04y\r\n" +
+ "Content-disposition: attachment; filename=\"file2.gif\"\r\n" +
+ "Content-type: image/gif\r\n" +
+ "Content-Transfer-Encoding: binary\r\n" +
+ "\r\n" +
+ "...contents of file2.gif...\r\n" +
+ "--BbC04y--\r\n" +
+ "--AaB03x--";
+ // @formatter:on
+ assertThrows(FileUploadBoundaryException.class,
+ () -> parseUpload(upload, request.getBytes(StandardCharsets.US_ASCII), contentType));
+ }
+
/**
* Test for multipart/related without any content-disposition Header.
* This kind of Content-Type is commonly used by SOAP-Requests with Attachments (MTOM)
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index d529ac6d..6d0ac4d3 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -45,6 +45,7 @@ The <action> type attribute can be add,update,fix,remove.
<!-- FIX -->
<action type="fix" dev="ggregory" due-to="Chenjp, Gary Gregory">Better exception message in org.apache.commons.fileupload2.core.AbstractFileUpload.parseRequest(RequestContext).</action>
<action issue="FILEUPLOAD-295" type="fix" dev="jochen">Clarified the precise meaning of isInMemory(), get(), getPath(), etc. in DiskFileItem</action>
+ <action type="fix" dev="markt" due-to="Coverity Scan">Better exception type and message if a multipart/mixed part is presented without a boundary defined</action>
<!-- ADD -->
<!-- UPDATE -->
<action type="update" dev="ggregory" due-to="Gary Gregory, Dependabot">Bump org.apache.commons:commons-parent from 84 to 87.</action>