Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-06 23:27:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

WW-5501 Uses StringUtils.normalizeSpace instead of sanitizeNewlines

Browse Source
This commit is contained in:
Lukasz Lenart
2024-12-23 14:13:26 +01:00
parent 09993e3476
commit 3ea126388c
3 changed files with 20 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java
-4
View File
@@ -180,8 +180,4 @@ public abstract class AbstractMultiPartRequest implements MultiPartRequest {
return patternsChecker.isAllowed(fileName).isAllowed();
}
protected String sanitizeNewlines(String before) {
return before.replaceAll("[\n\r]", "_");
}
}
core/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java
+9 -7
View File
@@ -44,6 +44,8 @@ import java.util.List;
import java.util.Map;
import java.util.Set;
import static org.apache.commons.lang3.StringUtils.normalizeSpace;
/**
* Multipart form data request adapter for Jakarta Commons Fileupload package.
*/
@@ -100,7 +102,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
protected void processUpload(HttpServletRequest request, String saveDir) throws FileUploadException, UnsupportedEncodingException {
if (ServletFileUpload.isMultipartContent(request)) {
for (FileItem item : parseRequest(request, saveDir)) {
LOG.debug("Found file item: [{}]", sanitizeNewlines(item.getFieldName()));
LOG.debug("Found file item: [{}]", normalizeSpace(item.getFieldName()));
if (item.isFormField()) {
processNormalFormField(item, request.getCharacterEncoding());
} else {
@@ -114,18 +116,18 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
LOG.debug("Item is a file upload");
if (!isAccepted(item.getName())) {
LOG.warn("File name [{}] is not accepted", sanitizeNewlines(item.getName()));
LOG.warn("File name [{}] is not accepted", normalizeSpace(item.getName()));
return;
}
if (!isAccepted(item.getFieldName())) {
LOG.warn("Field name [{}] is not accepted", sanitizeNewlines(item.getFieldName()));
LOG.warn("Field name [{}] is not accepted", normalizeSpace(item.getFieldName()));
return;
}
// Skip file uploads that don't have a file name - meaning that no file was selected.
if (item.getName() == null || item.getName().trim().isEmpty()) {
LOG.debug("No file has been uploaded for the field: {}", sanitizeNewlines(item.getFieldName()));
LOG.debug("No file has been uploaded for the field: {}", normalizeSpace(item.getFieldName()));
return;
}
@@ -145,7 +147,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
LOG.debug("Item is a normal form field");
if (!isAccepted(item.getFieldName())) {
LOG.warn("Form field name [{}] is not accepted", sanitizeNewlines(item.getFieldName()));
LOG.warn("Form field name [{}] is not accepted", normalizeSpace(item.getFieldName()));
return;
}
@@ -158,7 +160,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
long size = item.getSize();
if (maxStringLength != null && size > maxStringLength) {
LOG.debug("Form field [{}] of size [{}] bytes exceeds limit of [{}].", sanitizeNewlines(item.getFieldName()), size, maxStringLength);
LOG.debug("Form field [{}] of size [{}] bytes exceeds limit of [{}].", normalizeSpace(item.getFieldName()), size, maxStringLength);
String errorKey = "struts.messages.upload.error.parameter.too.long";
LocalizedMessage localizedMessage = new LocalizedMessage(this.getClass(), errorKey, null,
new Object[]{item.getFieldName(), maxStringLength, size});
@@ -374,7 +376,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
for (String name : names) {
List<FileItem> items = files.get(name);
for (FileItem item : items) {
LOG.debug("Removing file [{}]", sanitizeNewlines(name));
LOG.debug("Removing file [{}]", normalizeSpace(name));
if (!item.isInMemory()) {
item.delete();
}
core/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaStreamMultiPartRequest.java
+11 -8
View File
@@ -25,6 +25,7 @@ import org.apache.commons.fileupload.FileUploadBase.FileSizeLimitExceededExcepti
import org.apache.commons.fileupload.FileUploadException;
import org.apache.commons.fileupload.servlet.ServletFileUpload;
import org.apache.commons.fileupload.util.Streams;
import org.apache.commons.lang3.StringUtils;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.apache.struts2.dispatcher.LocalizedMessage;
@@ -45,6 +46,8 @@ import java.util.List;
import java.util.Map;
import java.util.UUID;
import static org.apache.commons.lang3.StringUtils.normalizeSpace;
/**
* Multi-part form data request adapter for Jakarta Commons FileUpload package that
* leverages the streaming API rather than the traditional non-streaming API.
@@ -252,7 +255,7 @@ public class JakartaStreamMultiPartRequest extends AbstractMultiPartRequest {
// prevent processing file field item if request size not allowed.
if (!requestSizePermitted) {
addFileSkippedError(itemStream.getName(), request);
LOG.debug("Skipped stream [{}], request maximum size ({}) exceeded.", sanitizeNewlines(itemStream.getName()), maxSize);
LOG.debug("Skipped stream [{}], request maximum size ({}) exceeded.", normalizeSpace(itemStream.getName()), maxSize);
continue;
}
@@ -296,7 +299,7 @@ public class JakartaStreamMultiPartRequest extends AbstractMultiPartRequest {
* @param request the servlet request
*/
protected void addFileSkippedError(String fileName, HttpServletRequest request) {
String exceptionMessage = "Skipped file " + sanitizeNewlines(fileName) + "; request size limit exceeded.";
String exceptionMessage = "Skipped file " + normalizeSpace(fileName) + "; request size limit exceeded.";
long allowedMaxSize = maxSize != null ? maxSize : -1;
FileSizeLimitExceededException exception = new FileUploadBase.FileSizeLimitExceededException(exceptionMessage, getRequestSize(request), allowedMaxSize);
LocalizedMessage message = buildErrorMessage(exception, new Object[]{fileName, getRequestSize(request), allowedMaxSize});
@@ -313,7 +316,7 @@ public class JakartaStreamMultiPartRequest extends AbstractMultiPartRequest {
protected void processFileItemStreamAsFormField(FileItemStream itemStream) {
String fieldName = itemStream.getFieldName();
if (!isAccepted(fieldName)) {
LOG.warn("Form field [{}] rejected!", sanitizeNewlines(fieldName));
LOG.warn("Form field [{}] rejected!", normalizeSpace(fieldName));
return;
}
try {
@@ -327,7 +330,7 @@ public class JakartaStreamMultiPartRequest extends AbstractMultiPartRequest {
}
values.add(fieldValue);
} catch (IOException e) {
LOG.warn("Failed to handle form field [{}]", sanitizeNewlines(fieldName), e);
LOG.warn("Failed to handle form field [{}]", normalizeSpace(fieldName), e);
}
}
@@ -340,12 +343,12 @@ public class JakartaStreamMultiPartRequest extends AbstractMultiPartRequest {
protected void processFileItemStreamAsFileField(FileItemStream itemStream, String location) {
// Skip file uploads that don't have a file name - meaning that no file was selected.
if (itemStream.getName() == null || itemStream.getName().trim().isEmpty()) {
LOG.debug("No file has been uploaded for the field: {}", sanitizeNewlines(itemStream.getFieldName()));
LOG.debug("No file has been uploaded for the field: {}", normalizeSpace(itemStream.getFieldName()));
return;
}
if (!isAccepted(itemStream.getName())) {
LOG.warn("File field [{}] rejected", sanitizeNewlines(itemStream.getName()));
LOG.warn("File field [{}] rejected", normalizeSpace(itemStream.getName()));
return;
}
@@ -362,7 +365,7 @@ public class JakartaStreamMultiPartRequest extends AbstractMultiPartRequest {
try {
file.delete();
} catch (SecurityException se) {
LOG.warn("Failed to delete [{}] due to security exception above.", sanitizeNewlines(file.getName()), se);
LOG.warn("Failed to delete [{}] due to security exception above.", normalizeSpace(file.getName()), se);
}
}
}
@@ -395,7 +398,7 @@ public class JakartaStreamMultiPartRequest extends AbstractMultiPartRequest {
File file = File.createTempFile(prefix + "_", suffix, new File(location));
if (LOG.isDebugEnabled()) {
LOG.debug("Creating temporary file [{}] (originally [{}]).", file.getName(), sanitizeNewlines(fileName));
LOG.debug("Creating temporary file [{}] (originally [{}]).", file.getName(), normalizeSpace(fileName));
}
return file;
}