From f94b6810502ccad743c4a915a3fcde25b5ff1e3c Mon Sep 17 00:00:00 2001 From: Yasser Zamani Date: Tue, 23 Apr 2019 09:32:43 +0430 Subject: [PATCH] fix multipart request RegEx Note: Unlike some similar constructs in other header fields, media type parameters do not allow whitespace (even "bad" whitespace) around the "=" character. Reference: https://tools.ietf.org/html/rfc7231#section-3.1.1.1 See also: WW-4958 --- .../org/apache/struts2/dispatcher/Dispatcher.java | 2 +- .../apache/struts2/dispatcher/DispatcherTest.java | 15 --------------- 2 files changed, 1 insertion(+), 16 deletions(-) diff --git a/core/src/main/java/org/apache/struts2/dispatcher/Dispatcher.java b/core/src/main/java/org/apache/struts2/dispatcher/Dispatcher.java index 87dc908f1..75ed51ed3 100644 --- a/core/src/main/java/org/apache/struts2/dispatcher/Dispatcher.java +++ b/core/src/main/java/org/apache/struts2/dispatcher/Dispatcher.java @@ -85,7 +85,7 @@ public class Dispatcher { */ public static final String REQUEST_POST_METHOD = "POST"; - public static final String MULTIPART_FORM_DATA_REGEX = "^multipart/form-data(?:\\s*;\\s*boundary\\s?=[0-9a-zA-Z'()+_,\\-./:=?]{1,70})?(?:\\s*;\\s*charset\\s?=\\s?[a-zA-Z\\-0-9]{3,14})?"; + public static final String MULTIPART_FORM_DATA_REGEX = "^multipart/form-data(?:\\s*;\\s*boundary=[0-9a-zA-Z'()+_,\\-./:=?]{1,70})?(?:\\s*;\\s*charset=[a-zA-Z\\-0-9]{3,14})?"; /** * Provide a thread local instance. diff --git a/core/src/test/java/org/apache/struts2/dispatcher/DispatcherTest.java b/core/src/test/java/org/apache/struts2/dispatcher/DispatcherTest.java index 5b0989a51..7c118743c 100644 --- a/core/src/test/java/org/apache/struts2/dispatcher/DispatcherTest.java +++ b/core/src/test/java/org/apache/struts2/dispatcher/DispatcherTest.java @@ -323,18 +323,6 @@ public class DispatcherTest extends StrutsInternalTestCase { req.setContentType("multipart/form-data;boundary=---------------------------207103069210263;charset=UTF-16LE"); assertTrue(du.isMultipartRequest(req)); - req.setContentType("multipart/form-data;boundary=---------------------------207103069210263 ; charset = UTF-16LE"); - assertTrue(du.isMultipartRequest(req)); - - req.setContentType("multipart/form-data;boundary=---------------------------207103069210263;charset = UTF-16LE"); - assertTrue(du.isMultipartRequest(req)); - - req.setContentType("multipart/form-data;boundary=---------------------------207103069210263;charset= UTF-16LE"); - assertTrue(du.isMultipartRequest(req)); - - req.setContentType("multipart/form-data;boundary=---------------------------207103069210263;charset =UTF-16LE"); - assertTrue(du.isMultipartRequest(req)); - req.setContentType("multipart/form-data;boundary=---------------------------207103069210263; charset=UTF-16LE"); assertTrue(du.isMultipartRequest(req)); @@ -350,9 +338,6 @@ public class DispatcherTest extends StrutsInternalTestCase { req.setContentType("multipart/form-data ; boundary=---------------------------207103069210263;charset=UTF-16LE"); assertTrue(du.isMultipartRequest(req)); - req.setContentType("multipart/form-data;boundary =---------------------------207103069210263;charset=UTF-16LE"); - assertTrue(du.isMultipartRequest(req)); - req.setContentType("Multipart/Form-Data ; boundary=---------------------------207103069210263;charset=UTF-16LE"); assertTrue(du.isMultipartRequest(req)); }