You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hc.apache.org by ol...@apache.org on 2022/11/07 13:48:31 UTC
[httpcomponents-client] branch 5.1.x updated (b5471a52f -> 3f86f9fb9)
This is an automated email from the ASF dual-hosted git repository.
olegk pushed a change to branch 5.1.x
in repository https://gitbox.apache.org/repos/asf/httpcomponents-client.git
discard b5471a52f Regression: Multipart body builder and multipart formatters fail to escape special characters such as backslash and quote mark
discard 769f1f3b4 Regression: Multipart body builder and multipart formatters fail to escape special characters such as backslash, quote mark and line breaks
new 3f86f9fb9 Regression: Multipart body builder and multipart formatters fail to escape special characters such as backslash and quote mark
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (b5471a52f)
\
N -- N -- N refs/heads/5.1.x (3f86f9fb9)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
[httpcomponents-client] 01/01: Regression: Multipart body builder and multipart formatters fail to escape special characters such as backslash and quote mark
Posted by ol...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
olegk pushed a commit to branch 5.1.x
in repository https://gitbox.apache.org/repos/asf/httpcomponents-client.git
commit 3f86f9fb9a884429fadb62530f9396280b05870c
Author: Oleg Kalnichevski <ol...@apache.org>
AuthorDate: Mon Nov 7 14:39:32 2022 +0100
Regression: Multipart body builder and multipart formatters fail to escape special characters such as backslash and quote mark
---
.../http/entity/mime/AbstractMultipartFormat.java | 47 ++++++++++++++++---
.../hc/client5/http/entity/mime/MimeField.java | 9 +++-
.../hc/client5/http/entity/mime/TestMimeField.java | 51 +++++++++++++++++++++
.../http/entity/mime/TestMultipartFormat.java | 53 ++++++++++++++++++++++
4 files changed, 152 insertions(+), 8 deletions(-)
diff --git a/httpclient5/src/main/java/org/apache/hc/client5/http/entity/mime/AbstractMultipartFormat.java b/httpclient5/src/main/java/org/apache/hc/client5/http/entity/mime/AbstractMultipartFormat.java
index 66b373b9a..3f3c2c8e0 100644
--- a/httpclient5/src/main/java/org/apache/hc/client5/http/entity/mime/AbstractMultipartFormat.java
+++ b/httpclient5/src/main/java/org/apache/hc/client5/http/entity/mime/AbstractMultipartFormat.java
@@ -47,7 +47,7 @@ import org.apache.hc.core5.util.ByteArrayBuffer;
abstract class AbstractMultipartFormat {
static ByteArrayBuffer encode(
- final Charset charset, final String string) {
+ final Charset charset, final CharSequence string) {
final ByteBuffer encoded = charset.encode(CharBuffer.wrap(string));
final ByteArrayBuffer bab = new ByteArrayBuffer(encoded.remaining());
bab.append(encoded.array(), encoded.arrayOffset() + encoded.position(), encoded.remaining());
@@ -60,30 +60,63 @@ abstract class AbstractMultipartFormat {
}
static void writeBytes(
- final String s, final Charset charset, final OutputStream out) throws IOException {
+ final CharSequence s, final Charset charset, final OutputStream out) throws IOException {
final ByteArrayBuffer b = encode(charset, s);
writeBytes(b, out);
}
static void writeBytes(
- final String s, final OutputStream out) throws IOException {
+ final CharSequence s, final OutputStream out) throws IOException {
final ByteArrayBuffer b = encode(StandardCharsets.ISO_8859_1, s);
writeBytes(b, out);
}
+ static boolean isLineBreak(final char ch) {
+ return ch == '\r' || ch == '\n' || ch == '\f' || ch == 11;
+ }
+
+ static CharSequence stripLineBreaks(final CharSequence s) {
+ if (s == null) {
+ return null;
+ }
+ boolean requiresRewrite = false;
+ int n = 0;
+ for (; n < s.length(); n++) {
+ final char ch = s.charAt(n);
+ if (isLineBreak(ch)) {
+ requiresRewrite = true;
+ break;
+ }
+ }
+ if (!requiresRewrite) {
+ return s;
+ }
+ final StringBuilder buf = new StringBuilder();
+ buf.append(s, 0, n);
+ for (; n < s.length(); n++) {
+ final char ch = s.charAt(n);
+ if (isLineBreak(ch)) {
+ buf.append(' ');
+ } else {
+ buf.append(ch);
+ }
+ }
+ return buf.toString();
+ }
+
static void writeField(
final MimeField field, final OutputStream out) throws IOException {
- writeBytes(field.getName(), out);
+ writeBytes(stripLineBreaks(field.getName()), out);
writeBytes(FIELD_SEP, out);
- writeBytes(field.getBody(), out);
+ writeBytes(stripLineBreaks(field.getBody()), out);
writeBytes(CR_LF, out);
}
static void writeField(
final MimeField field, final Charset charset, final OutputStream out) throws IOException {
- writeBytes(field.getName(), charset, out);
+ writeBytes(stripLineBreaks(field.getName()), charset, out);
writeBytes(FIELD_SEP, out);
- writeBytes(field.getBody(), charset, out);
+ writeBytes(stripLineBreaks(field.getBody()), charset, out);
writeBytes(CR_LF, out);
}
diff --git a/httpclient5/src/main/java/org/apache/hc/client5/http/entity/mime/MimeField.java b/httpclient5/src/main/java/org/apache/hc/client5/http/entity/mime/MimeField.java
index 3b2c681c7..d305a39c4 100644
--- a/httpclient5/src/main/java/org/apache/hc/client5/http/entity/mime/MimeField.java
+++ b/httpclient5/src/main/java/org/apache/hc/client5/http/entity/mime/MimeField.java
@@ -84,7 +84,14 @@ public class MimeField {
sb.append("; ");
sb.append(parameter.getName());
sb.append("=\"");
- sb.append(parameter.getValue());
+ final String v = parameter.getValue();
+ for (int n = 0; n < v.length(); n++) {
+ final char ch = v.charAt(n);
+ if (ch == '"' || ch == '\\' ) {
+ sb.append("\\");
+ }
+ sb.append(ch);
+ }
sb.append("\"");
}
return sb.toString();
diff --git a/httpclient5/src/test/java/org/apache/hc/client5/http/entity/mime/TestMimeField.java b/httpclient5/src/test/java/org/apache/hc/client5/http/entity/mime/TestMimeField.java
new file mode 100644
index 000000000..7a15cea2e
--- /dev/null
+++ b/httpclient5/src/test/java/org/apache/hc/client5/http/entity/mime/TestMimeField.java
@@ -0,0 +1,51 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation. For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package org.apache.hc.client5.http.entity.mime;
+
+import java.util.Arrays;
+
+import org.apache.hc.core5.http.NameValuePair;
+import org.apache.hc.core5.http.message.BasicNameValuePair;
+import org.junit.Assert;
+import org.junit.Test;
+
+public class TestMimeField {
+
+ @Test
+ public void testBasics() {
+ final MimeField f1 = new MimeField("some-field", "some-value",
+ Arrays.<NameValuePair>asList(
+ new BasicNameValuePair("p1", "this"),
+ new BasicNameValuePair("p2", "that"),
+ new BasicNameValuePair("p3", "\"this \\and\\ that\"")));
+ Assert.assertEquals("some-field", f1.getName());
+ Assert.assertEquals("some-value", f1.getValue());
+ Assert.assertEquals("some-value; p1=\"this\"; p2=\"that\"; p3=\"\\\"this \\\\and\\\\ that\\\"\"", f1.getBody());
+ }
+
+}
\ No newline at end of file
diff --git a/httpclient5/src/test/java/org/apache/hc/client5/http/entity/mime/TestMultipartFormat.java b/httpclient5/src/test/java/org/apache/hc/client5/http/entity/mime/TestMultipartFormat.java
new file mode 100644
index 000000000..07e98c0ef
--- /dev/null
+++ b/httpclient5/src/test/java/org/apache/hc/client5/http/entity/mime/TestMultipartFormat.java
@@ -0,0 +1,53 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation. For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package org.apache.hc.client5.http.entity.mime;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+public class TestMultipartFormat {
+
+ @Test
+ public void testLineBreak() {
+ Assert.assertTrue(AbstractMultipartFormat.isLineBreak('\r'));
+ Assert.assertTrue(AbstractMultipartFormat.isLineBreak('\n'));
+ Assert.assertTrue(AbstractMultipartFormat.isLineBreak('\f'));
+ Assert.assertTrue(AbstractMultipartFormat.isLineBreak((char) 11));
+ Assert.assertFalse(AbstractMultipartFormat.isLineBreak(' '));
+ Assert.assertFalse(AbstractMultipartFormat.isLineBreak('x'));
+ }
+
+ @Test
+ public void testLineBreakRewrite() {
+ final String s = "blah blah blah";
+ Assert.assertSame(s, AbstractMultipartFormat.stripLineBreaks(s));
+ Assert.assertEquals("blah blah blah ", AbstractMultipartFormat.stripLineBreaks("blah\rblah\nblah\f"));
+ Assert.assertEquals(" f", AbstractMultipartFormat.stripLineBreaks("\r\n\r\nf"));
+ }
+
+}
\ No newline at end of file