You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@commons.apache.org by "nicktarallo (via GitHub)" <gi...@apache.org> on 2026/07/14 05:49:59 UTC
[PR] [VFS-863] Content inside brackets in directory names is not decoded [commons-vfs]
nicktarallo opened a new pull request, #773:
URL: https://github.com/apache/commons-vfs/pull/773
In VFS 2.10, content inside brackets in the file URL is not decoded. This is because it is detected to be part of an IPv6 host, although this may not be desired behavior in all circumstances (local file paths that happen to have content in brackets are also affected, despite being unrelated to IPv6).
The fix here is to ensure that we only detect a host inside of the authority as defined by RFC 3986. We do this by detecting the authority as the content between the first instance of `"//"` and the next `"/"`, since the URL takes the format `scheme://<authority>/<path>`. Brackets `outside` of the authority hold no special meaning, so content inside of these brackets will now be decoded.
Bug was most likely introduced by: https://github.com/apache/commons-vfs/pull/438/changes#diff-731c9fd149c7d934456163a6eb8c1afebc6be0669986e8ccf5092f164ea0cd30R166
There appears to be another old, stale PR out for the same issue, but I could not find an associated ticket: https://github.com/apache/commons-vfs/pull/562
AI (Claude Code) was used to write most of the code (I reviewed all output). The fix approach and the design of the test cases were provided by me to the tool.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [VFS-863] Content inside brackets in directory/file names is not decoded [commons-vfs]
Posted by "nicktarallo (via GitHub)" <gi...@apache.org>.
nicktarallo commented on PR #773:
URL: https://github.com/apache/commons-vfs/pull/773#issuecomment-4965868901
Hi @garydgregory, this was discussed briefly in the user mailing list, made a PR to try to address the issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [VFS-863] Content inside brackets in directory/file names is not decoded [commons-vfs]
Posted by "nicktarallo (via GitHub)" <gi...@apache.org>.
nicktarallo commented on PR #773:
URL: https://github.com/apache/commons-vfs/pull/773#issuecomment-4977165356
> Hello @nicktarallo Thank you for the PR. Please review the comments from copilot. You might need to add a test in check the main suggestion. The test suggestion seems like a test bug.
Hi @garydgregory, thanks for the review. I addressed both comments:
- Authority detection now only triggers on a leading // (network-path reference) or on :// following the scheme. Added regression tests for the file:/a//[...] example from the review, a :// embedded in the path after the authority, and a URI mixing an IPv6 zone ID with brackets in the path.
- Wrapped the Files.walk stream in try-with-resources.
Also verified all 4 new test methods fail against the pre-fix code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [VFS-863] Content inside brackets in directory/file names is not decoded [commons-vfs]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #773:
URL: https://github.com/apache/commons-vfs/pull/773#discussion_r3580895897
##########
commons-vfs2/src/main/java/org/apache/commons/vfs2/provider/UriParser.java:
##########
@@ -161,12 +161,29 @@ public static void decode(final StringBuilder buffer, final int offset, final in
int index = offset;
int count = length;
boolean ipv6Host = false;
+ boolean authorityDetected = false;
+ boolean inAuthority = false;
+ int consecutiveSlashes = 0;
for (; count > 0; count--, index++) {
final char ch = buffer.charAt(index);
- if (ch == '[') {
- ipv6Host = true;
- }
- if (ch == ']') {
+ if (!authorityDetected) {
+ if (ch == '/') {
+ consecutiveSlashes++;
+ if (consecutiveSlashes == 2) {
+ inAuthority = true;
+ authorityDetected = true;
+ }
Review Comment:
Authority detection currently triggers on any "//" sequence anywhere in the string. For inputs that have no authority but contain "//" later in the path (e.g., "file:/a//[inside%25text]" or other non-hierarchical URIs), this will incorrectly treat subsequent "[...]" as an IPv6 host and skip percent-decoding inside the brackets, reintroducing the original bug for those cases. Limit authority detection to a leading "//" (network-path reference) or to "://" immediately after a scheme delimiter.
##########
commons-vfs2/src/test/java/org/apache/commons/vfs2/provider/local/UrlTests.java:
##########
@@ -65,4 +70,31 @@ public void testHashURL() throws Exception {
assertEquals(file.toString(), UriParser.decode(file.getURL().toString()));
}
+ /**
+ * Tests that getURL() round-trips correctly when a directory name contains brackets.
+ */
+ @Test
+ public void testGetUrlRoundTripWithBracketsInPath() throws Exception {
+ final Path tmp = Files.createTempDirectory("vfs-roundtrip");
+ try {
+ final Path child = tmp.resolve("outside%text[inside%text]tail");
+ Files.createDirectories(child);
+
+ final FileSystemManager mgr = VFS.getManager();
+ final FileObject a = mgr.resolveFile(child.toUri().toString());
+ final FileObject b = mgr.resolveFile(a.getURL().toString());
+
+ assertEquals(a.getName().getPath(), b.getName().getPath());
+ } finally {
+ Files.walk(tmp)
+ .sorted(Comparator.reverseOrder())
+ .forEach(p -> {
+ try {
+ Files.delete(p);
+ } catch (final IOException ignore) { // NOPMD
+ }
+ });
Review Comment:
Files.walk(tmp) returns a Stream that must be closed. Not closing it can leak file handles and (notably on Windows) can prevent the subsequent delete operations from succeeding reliably. Wrap the walk in a try-with-resources.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [VFS-863] Content inside brackets in directory/file names is not decoded [commons-vfs]
Posted by "garydgregory (via GitHub)" <gi...@apache.org>.
garydgregory merged PR #773:
URL: https://github.com/apache/commons-vfs/pull/773
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [VFS-863] Content inside brackets in directory/file names is not decoded [commons-vfs]
Posted by "garydgregory (via GitHub)" <gi...@apache.org>.
garydgregory commented on PR #773:
URL: https://github.com/apache/commons-vfs/pull/773#issuecomment-5008598503
@nicktarallo PR merged 🚀 Thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org