You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cxf.apache.org by "dxbjavid (via GitHub)" <gi...@apache.org> on 2026/06/16 09:15:32 UTC
[PR] validate hex digits when decoding quoted-printable attachments [cxf]
dxbjavid opened a new pull request, #3223:
URL: https://github.com/apache/cxf/pull/3223
an inbound multipart attachment whose Content-Transfer-Encoding is quoted-printable is decoded by QuotedPrintableDecoderStream, which looks each of the two bytes following an '=' up in a 128 entry table without checking they are hex digits. a byte of 0x80 or above arrives as a negative java byte and throws ArrayIndexOutOfBoundsException, an invalid ascii pair like =GG is silently turned into 0x00, and a lowercase pair like =e2 decodes to the wrong byte because the table only holds the uppercase forms. this decodes each nibble with Character.digit over the unsigned byte and refuses anything that isn't valid hex, so malformed input is rejected rather than mis-decoded or crashing the parser.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] validate hex digits when decoding quoted-printable attachments [cxf]
Posted by "reta (via GitHub)" <gi...@apache.org>.
reta commented on code in PR #3223:
URL: https://github.com/apache/cxf/pull/3223#discussion_r3432912353
##########
core/src/test/java/org/apache/cxf/attachment/QuotedPrintableDecoderStreamTest.java:
##########
@@ -0,0 +1,66 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.attachment;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertThrows;
+
+public class QuotedPrintableDecoderStreamTest {
+
+ private static byte[] decode(byte[] encoded) throws IOException {
+ InputStream in = new QuotedPrintableDecoderStream(new ByteArrayInputStream(encoded));
+ ByteArrayOutputStream out = new ByteArrayOutputStream();
+ int b;
+ while ((b = in.read()) != -1) {
+ out.write(b);
+ }
+ return out.toByteArray();
+ }
+
+ @Test
+ public void testDecodesHexPair() throws Exception {
+ assertArrayEquals("hello world".getBytes("US-ASCII"),
Review Comment:
```suggestion
assertArrayEquals("hello world".getBytes(StandardCharsets.US_ASCII),
```
To address PMD violations, there a few other places in this test with the same issue
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] validate hex digits when decoding quoted-printable attachments [cxf]
Posted by "reta (via GitHub)" <gi...@apache.org>.
reta merged PR #3223:
URL: https://github.com/apache/cxf/pull/3223
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] validate hex digits when decoding quoted-printable attachments [cxf]
Posted by "dxbjavid (via GitHub)" <gi...@apache.org>.
dxbjavid commented on code in PR #3223:
URL: https://github.com/apache/cxf/pull/3223#discussion_r3433130339
##########
core/src/test/java/org/apache/cxf/attachment/QuotedPrintableDecoderStreamTest.java:
##########
@@ -0,0 +1,66 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.attachment;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertThrows;
+
+public class QuotedPrintableDecoderStreamTest {
+
+ private static byte[] decode(byte[] encoded) throws IOException {
+ InputStream in = new QuotedPrintableDecoderStream(new ByteArrayInputStream(encoded));
+ ByteArrayOutputStream out = new ByteArrayOutputStream();
+ int b;
+ while ((b = in.read()) != -1) {
+ out.write(b);
+ }
+ return out.toByteArray();
+ }
+
+ @Test
+ public void testDecodesHexPair() throws Exception {
+ assertArrayEquals("hello world".getBytes("US-ASCII"),
Review Comment:
done, swapped all four getBytes calls in the test over to StandardCharsets.US_ASCII.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] validate hex digits when decoding quoted-printable attachments [cxf]
Posted by "dxbjavid (via GitHub)" <gi...@apache.org>.
dxbjavid commented on PR #3223:
URL: https://github.com/apache/cxf/pull/3223#issuecomment-4726387713
good call, switched both nibbles over to HexFormat.fromHexDigit and wrapped the NumberFormatException as the IOException. the high-bit byte and lowercase cases still behave the same, and the custom table is gone now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] validate hex digits when decoding quoted-printable attachments [cxf]
Posted by "reta (via GitHub)" <gi...@apache.org>.
reta commented on PR #3223:
URL: https://github.com/apache/cxf/pull/3223#issuecomment-4725345400
Thanks @dxbjavid , our baseline for 4.2/4.1 release line is JDK-17, could we please replace this custom hex coding / decoding logic with https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/HexFormat.html ? Thank you.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] validate hex digits when decoding quoted-printable attachments [cxf]
Posted by "dxbjavid (via GitHub)" <gi...@apache.org>.
dxbjavid commented on PR #3223:
URL: https://github.com/apache/cxf/pull/3223#issuecomment-4748321216
Thank you for the review and merge. Much appreciated
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org