diff --git a/core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java b/core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java index f19b9ebd2..ed013b724 100644 --- a/core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java +++ b/core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java @@ -180,8 +180,4 @@ public abstract class AbstractMultiPartRequest implements MultiPartRequest { return patternsChecker.isAllowed(fileName).isAllowed(); } - protected String sanitizeNewlines(String before) { - return before.replaceAll("[\n\r]", "_"); - } - } diff --git a/core/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java b/core/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java index e6acf8a6f..0367ac5e6 100644 --- a/core/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java +++ b/core/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java @@ -44,6 +44,8 @@ import java.util.List; import java.util.Map; import java.util.Set; +import static org.apache.commons.lang3.StringUtils.normalizeSpace; + /** * Multipart form data request adapter for Jakarta Commons Fileupload package. */ @@ -100,7 +102,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest { protected void processUpload(HttpServletRequest request, String saveDir) throws FileUploadException, UnsupportedEncodingException { if (ServletFileUpload.isMultipartContent(request)) { for (FileItem item : parseRequest(request, saveDir)) { - LOG.debug("Found file item: [{}]", sanitizeNewlines(item.getFieldName())); + LOG.debug("Found file item: [{}]", normalizeSpace(item.getFieldName())); if (item.isFormField()) { processNormalFormField(item, request.getCharacterEncoding()); } else { @@ -114,18 +116,18 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest { LOG.debug("Item is a file upload"); if (!isAccepted(item.getName())) { - LOG.warn("File name [{}] is not accepted", sanitizeNewlines(item.getName())); + LOG.warn("File name [{}] is not accepted", normalizeSpace(item.getName())); return; } if (!isAccepted(item.getFieldName())) { - LOG.warn("Field name [{}] is not accepted", sanitizeNewlines(item.getFieldName())); + LOG.warn("Field name [{}] is not accepted", normalizeSpace(item.getFieldName())); return; } // Skip file uploads that don't have a file name - meaning that no file was selected. if (item.getName() == null || item.getName().trim().isEmpty()) { - LOG.debug("No file has been uploaded for the field: {}", sanitizeNewlines(item.getFieldName())); + LOG.debug("No file has been uploaded for the field: {}", normalizeSpace(item.getFieldName())); return; } @@ -145,7 +147,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest { LOG.debug("Item is a normal form field"); if (!isAccepted(item.getFieldName())) { - LOG.warn("Form field name [{}] is not accepted", sanitizeNewlines(item.getFieldName())); + LOG.warn("Form field name [{}] is not accepted", normalizeSpace(item.getFieldName())); return; } @@ -158,7 +160,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest { long size = item.getSize(); if (maxStringLength != null && size > maxStringLength) { - LOG.debug("Form field [{}] of size [{}] bytes exceeds limit of [{}].", sanitizeNewlines(item.getFieldName()), size, maxStringLength); + LOG.debug("Form field [{}] of size [{}] bytes exceeds limit of [{}].", normalizeSpace(item.getFieldName()), size, maxStringLength); String errorKey = "struts.messages.upload.error.parameter.too.long"; LocalizedMessage localizedMessage = new LocalizedMessage(this.getClass(), errorKey, null, new Object[]{item.getFieldName(), maxStringLength, size}); @@ -374,7 +376,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest { for (String name : names) { List items = files.get(name); for (FileItem item : items) { - LOG.debug("Removing file [{}]", sanitizeNewlines(name)); + LOG.debug("Removing file [{}]", normalizeSpace(name)); if (!item.isInMemory()) { item.delete(); } diff --git a/core/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaStreamMultiPartRequest.java b/core/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaStreamMultiPartRequest.java index 539fd6cbb..9abe7a011 100644 --- a/core/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaStreamMultiPartRequest.java +++ b/core/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaStreamMultiPartRequest.java @@ -25,6 +25,7 @@ import org.apache.commons.fileupload.FileUploadBase.FileSizeLimitExceededExcepti import org.apache.commons.fileupload.FileUploadException; import org.apache.commons.fileupload.servlet.ServletFileUpload; import org.apache.commons.fileupload.util.Streams; +import org.apache.commons.lang3.StringUtils; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import org.apache.struts2.dispatcher.LocalizedMessage; @@ -45,6 +46,8 @@ import java.util.List; import java.util.Map; import java.util.UUID; +import static org.apache.commons.lang3.StringUtils.normalizeSpace; + /** * Multi-part form data request adapter for Jakarta Commons FileUpload package that * leverages the streaming API rather than the traditional non-streaming API. @@ -252,7 +255,7 @@ public class JakartaStreamMultiPartRequest extends AbstractMultiPartRequest { // prevent processing file field item if request size not allowed. if (!requestSizePermitted) { addFileSkippedError(itemStream.getName(), request); - LOG.debug("Skipped stream [{}], request maximum size ({}) exceeded.", sanitizeNewlines(itemStream.getName()), maxSize); + LOG.debug("Skipped stream [{}], request maximum size ({}) exceeded.", normalizeSpace(itemStream.getName()), maxSize); continue; } @@ -296,7 +299,7 @@ public class JakartaStreamMultiPartRequest extends AbstractMultiPartRequest { * @param request the servlet request */ protected void addFileSkippedError(String fileName, HttpServletRequest request) { - String exceptionMessage = "Skipped file " + sanitizeNewlines(fileName) + "; request size limit exceeded."; + String exceptionMessage = "Skipped file " + normalizeSpace(fileName) + "; request size limit exceeded."; long allowedMaxSize = maxSize != null ? maxSize : -1; FileSizeLimitExceededException exception = new FileUploadBase.FileSizeLimitExceededException(exceptionMessage, getRequestSize(request), allowedMaxSize); LocalizedMessage message = buildErrorMessage(exception, new Object[]{fileName, getRequestSize(request), allowedMaxSize}); @@ -313,7 +316,7 @@ public class JakartaStreamMultiPartRequest extends AbstractMultiPartRequest { protected void processFileItemStreamAsFormField(FileItemStream itemStream) { String fieldName = itemStream.getFieldName(); if (!isAccepted(fieldName)) { - LOG.warn("Form field [{}] rejected!", sanitizeNewlines(fieldName)); + LOG.warn("Form field [{}] rejected!", normalizeSpace(fieldName)); return; } try { @@ -327,7 +330,7 @@ public class JakartaStreamMultiPartRequest extends AbstractMultiPartRequest { } values.add(fieldValue); } catch (IOException e) { - LOG.warn("Failed to handle form field [{}]", sanitizeNewlines(fieldName), e); + LOG.warn("Failed to handle form field [{}]", normalizeSpace(fieldName), e); } } @@ -340,12 +343,12 @@ public class JakartaStreamMultiPartRequest extends AbstractMultiPartRequest { protected void processFileItemStreamAsFileField(FileItemStream itemStream, String location) { // Skip file uploads that don't have a file name - meaning that no file was selected. if (itemStream.getName() == null || itemStream.getName().trim().isEmpty()) { - LOG.debug("No file has been uploaded for the field: {}", sanitizeNewlines(itemStream.getFieldName())); + LOG.debug("No file has been uploaded for the field: {}", normalizeSpace(itemStream.getFieldName())); return; } if (!isAccepted(itemStream.getName())) { - LOG.warn("File field [{}] rejected", sanitizeNewlines(itemStream.getName())); + LOG.warn("File field [{}] rejected", normalizeSpace(itemStream.getName())); return; } @@ -362,7 +365,7 @@ public class JakartaStreamMultiPartRequest extends AbstractMultiPartRequest { try { file.delete(); } catch (SecurityException se) { - LOG.warn("Failed to delete [{}] due to security exception above.", sanitizeNewlines(file.getName()), se); + LOG.warn("Failed to delete [{}] due to security exception above.", normalizeSpace(file.getName()), se); } } } @@ -395,7 +398,7 @@ public class JakartaStreamMultiPartRequest extends AbstractMultiPartRequest { File file = File.createTempFile(prefix + "_", suffix, new File(location)); if (LOG.isDebugEnabled()) { - LOG.debug("Creating temporary file [{}] (originally [{}]).", file.getName(), sanitizeNewlines(fileName)); + LOG.debug("Creating temporary file [{}] (originally [{}]).", file.getName(), normalizeSpace(fileName)); } return file; }