You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hc.apache.org by ol...@apache.org on 2026/08/30 09:09:22 UTC
(httpcomponents-core) branch master updated: PercentCodec decoder to disallow non-ASCII characters in input
This is an automated email from the ASF dual-hosted git repository.
ok2c pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/httpcomponents-core.git
The following commit(s) were added to refs/heads/master by this push:
new 9eb6c1fc5 PercentCodec decoder to disallow non-ASCII characters in input
9eb6c1fc5 is described below
commit 9eb6c1fc5110f62b3b8b52763f14b035a30866ba
Author: Oleg Kalnichevski <ol...@apache.org>
AuthorDate: Fri Aug 28 12:05:39 2026 +0200
PercentCodec decoder to disallow non-ASCII characters in input
---
.../java/org/apache/hc/core5/net/PercentCodec.java | 6 +++++-
.../org/apache/hc/core5/net/TestPercentCodec.java | 22 ++++++++++++++++++++++
2 files changed, 27 insertions(+), 1 deletion(-)
diff --git a/httpcore5/src/main/java/org/apache/hc/core5/net/PercentCodec.java b/httpcore5/src/main/java/org/apache/hc/core5/net/PercentCodec.java
index 3e1700002..2a7f30b38 100644
--- a/httpcore5/src/main/java/org/apache/hc/core5/net/PercentCodec.java
+++ b/httpcore5/src/main/java/org/apache/hc/core5/net/PercentCodec.java
@@ -236,7 +236,11 @@ static String decode(final CharSequence content, final Charset charset, final bo
} else if (plusAsBlank && c == '+') {
bb.put((byte) ' ');
} else {
- bb.put((byte) c);
+ if (c > 0x7f) {
+ bb.put((byte) '?');
+ } else {
+ bb.put((byte) c);
+ }
}
}
bb.flip();
diff --git a/httpcore5/src/test/java/org/apache/hc/core5/net/TestPercentCodec.java b/httpcore5/src/test/java/org/apache/hc/core5/net/TestPercentCodec.java
index 7c1b72aea..c6a2b0459 100644
--- a/httpcore5/src/test/java/org/apache/hc/core5/net/TestPercentCodec.java
+++ b/httpcore5/src/test/java/org/apache/hc/core5/net/TestPercentCodec.java
@@ -116,4 +116,26 @@ void testPercentCodecEncodeIsNotRfc7639Canonical() {
assertEquals("%7C", PercentCodec.encode("|", StandardCharsets.UTF_8));
}
+ @Test
+ void decodeIllegalChars() {
+ assertEquals(
+ "1?2?3?4",
+ PercentCodec.decode("1\u012E2\u012E3\u012E4", StandardCharsets.UTF_8));
+ }
+
+ @Test
+ void testDecodeDoesNotCombineEscapedBytesAcrossLiteralCharacters() {
+ assertEquals(
+ "\uFFFDx\uFFFD",
+ PercentCodec.decode("%C3x%A4", StandardCharsets.UTF_8));
+ }
+
+ @Test
+ void testEncodeHonorsUtf16Charset() {
+ assertEquals(
+ "%FE%FF%00a%00b%00c",
+ PercentCodec.encode("abc", StandardCharsets.UTF_16));
+
+ }
+
}