You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@commons.apache.org by "alhudz (via GitHub)" <gi...@apache.org> on 2026/07/15 15:59:20 UTC
[PR] reject malformed base64 payload in RFC 2047 decodeWord [commons-fileupload]
alhudz opened a new pull request, #478:
URL: https://github.com/apache/commons-fileupload/pull/478
`MimeUtils.decodeWord` decodes an RFC 2047 encoded-word reached from a `Content-Disposition` / `Content-Type` parameter (`filename`, `name`, `boundary`) via `ParameterParser`. The base64 branch calls `Base64.getMimeDecoder().decode(...)`, which throws `IllegalArgumentException` on a malformed final unit. That is not caught by the surrounding `catch (IOException)`, so it escapes the method's declared `throws ParseException, UnsupportedEncodingException`. The quoted-printable branch throws `IOException` on the same kind of malformed input and is remapped cleanly, so the two encodings reject bad input inconsistently.
Repro: `MimeUtils.decodeText("=?UTF-8?B?A?=")` (payload is a single base64 char).
Expected: `UnsupportedEncodingException`, as for a malformed `Q` payload.
Actual: `IllegalArgumentException` ("Last unit does not have enough valid bits").
Widen the existing catch to `IOException | IllegalArgumentException` so a malformed base64 payload is rejected like a malformed quoted-printable one. Keeping the mapping in `decodeWord` keeps both encodings within the same declared contract instead of leaking a base64-specific runtime exception. Covered by a new case in `MimeUtilityTestCase`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Reject malformed base64 payload in RFC 2047 decodeWord [commons-fileupload]
Posted by "garydgregory (via GitHub)" <gi...@apache.org>.
garydgregory commented on PR #478:
URL: https://github.com/apache/commons-fileupload/pull/478#issuecomment-4983986225
Thank you @alhudz Please port to 1.x.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Reject malformed base64 payload in RFC 2047 decodeWord [commons-fileupload]
Posted by "garydgregory (via GitHub)" <gi...@apache.org>.
garydgregory merged PR #478:
URL: https://github.com/apache/commons-fileupload/pull/478
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org