Skip to content

Commit bb684ce

Browse files
rstoyanchevrstoyanchev
committed
Improve decoding support for multipart filename
StandardMultipartHttpServletRequest now properly decodes RFC-5987 encoded filenames (i.e. filename*) by delegating to ContentDisposition and also support RFC-2047 syntax through javax.mail MimeUtility. Issue: SPR-15205
1 parent 2437500 commit bb684ce

File tree

3 files changed

+102
-71
lines changed

3 files changed

+102
-71
lines changed

‎spring-web/src/main/java/org/springframework/web/multipart/support/StandardMultipartHttpServletRequest.java

Lines changed: 25 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,7 @@
2020
import java.io.IOException;
2121
import java.io.InputStream;
2222
import java.io.Serializable;
23-
import java.nio.charset.Charset;
24-
import java.nio.charset.StandardCharsets;
23+
import java.io.UnsupportedEncodingException;
2524
import java.nio.file.Files;
2625
import java.util.ArrayList;
2726
import java.util.Collection;
@@ -31,9 +30,11 @@
3130
import java.util.LinkedHashSet;
3231
import java.util.Map;
3332
import java.util.Set;
33+
import javax.mail.internet.MimeUtility;
3434
import javax.servlet.http.HttpServletRequest;
3535
import javax.servlet.http.Part;
3636

37+
import org.springframework.http.ContentDisposition;
3738
import org.springframework.http.HttpHeaders;
3839
import org.springframework.lang.Nullable;
3940
import org.springframework.util.FileCopyUtils;
@@ -54,13 +55,6 @@
5455
*/
5556
public class StandardMultipartHttpServletRequest extends AbstractMultipartHttpServletRequest {
5657

57-
private static final String CONTENT_DISPOSITION = "content-disposition";
58-
59-
private static final String FILENAME_KEY = "filename=";
60-
61-
private static final String FILENAME_WITH_CHARSET_KEY = "filename*=";
62-
63-
6458
@Nullable
6559
private Set<String> multipartParameterNames;
6660

@@ -96,12 +90,13 @@ private void parseRequest(HttpServletRequest request) {
9690
this.multipartParameterNames = new LinkedHashSet<>(parts.size());
9791
MultiValueMap<String, MultipartFile> files = new LinkedMultiValueMap<>(parts.size());
9892
for (Part part : parts) {
99-
String disposition = part.getHeader(CONTENT_DISPOSITION);
100-
String filename = extractFilename(disposition);
101-
if (filename == null) {
102-
filename = extractFilenameWithCharset(disposition);
103-
}
93+
String headerValue = part.getHeader(HttpHeaders.CONTENT_DISPOSITION);
94+
ContentDisposition disposition = ContentDisposition.parse(headerValue);
95+
String filename = disposition.getFilename();
10496
if (filename != null) {
97+
if (filename.startsWith("=?") && filename.endsWith("?=")) {
98+
filename = MimeDelegate.decode(filename);
99+
}
105100
files.add(part.getName(), new StandardMultipartFile(part, filename));
106101
}
107102
else {
@@ -123,62 +118,6 @@ protected void handleParseFailure(Throwable ex) {
123118
throw new MultipartException("Failed to parse multipart servlet request", ex);
124119
}
125120

126-
@Nullable
127-
private String extractFilename(String contentDisposition, String key) {
128-
int startIndex = contentDisposition.indexOf(key);
129-
if (startIndex == -1) {
130-
return null;
131-
}
132-
String filename = contentDisposition.substring(startIndex + key.length());
133-
if (filename.startsWith("\"")) {
134-
int endIndex = filename.indexOf("\"", 1);
135-
if (endIndex != -1) {
136-
return filename.substring(1, endIndex);
137-
}
138-
}
139-
else {
140-
int endIndex = filename.indexOf(";");
141-
if (endIndex != -1) {
142-
return filename.substring(0, endIndex);
143-
}
144-
}
145-
return filename;
146-
}
147-
148-
@Nullable
149-
private String extractFilename(String contentDisposition) {
150-
return extractFilename(contentDisposition, FILENAME_KEY);
151-
}
152-
153-
@Nullable
154-
private String extractFilenameWithCharset(String contentDisposition) {
155-
String filename = extractFilename(contentDisposition, FILENAME_WITH_CHARSET_KEY);
156-
if (filename == null) {
157-
return null;
158-
}
159-
int index = filename.indexOf("'");
160-
if (index != -1) {
161-
Charset charset = null;
162-
try {
163-
charset = Charset.forName(filename.substring(0, index));
164-
}
165-
catch (IllegalArgumentException ex) {
166-
// ignore
167-
}
168-
filename = filename.substring(index + 1);
169-
// Skip language information..
170-
index = filename.indexOf("'");
171-
if (index != -1) {
172-
filename = filename.substring(index + 1);
173-
}
174-
if (charset != null) {
175-
filename = new String(filename.getBytes(StandardCharsets.US_ASCII), charset);
176-
}
177-
}
178-
return filename;
179-
}
180-
181-
182121
@Override
183122
protected void initializeMultipart() {
184123
parseRequest(getRequest());
@@ -322,4 +261,20 @@ public void transferTo(File dest) throws IOException, IllegalStateException {
322261
}
323262
}
324263

264+
265+
/**
266+
* Inner class to avoid a hard dependency on the JavaMail API.
267+
*/
268+
private static class MimeDelegate {
269+
270+
public static String decode(String value) {
271+
try {
272+
return MimeUtility.decodeText(value);
273+
}
274+
catch (UnsupportedEncodingException ex) {
275+
throw new IllegalStateException(ex);
276+
}
277+
}
278+
}
279+
325280
}

‎spring-web/src/test/java/org/springframework/web/multipart/support/StandardMultipartHttpServletRequestTests.java

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
/*
2+
* Copyright 2002-2017 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package org.springframework.web.multipart.support;
17+
18+
import org.junit.Test;
19+
20+
import org.springframework.mock.web.test.MockHttpServletRequest;
21+
import org.springframework.mock.web.test.MockPart;
22+
import org.springframework.web.multipart.MultipartFile;
23+
24+
import static org.junit.Assert.assertEquals;
25+
import static org.junit.Assert.assertNotNull;
26+
27+
/**
28+
* Unit tests for {@link StandardMultipartHttpServletRequest}.
29+
* @author Rossen Stoyanchev
30+
*/
31+
public class StandardMultipartHttpServletRequestTests {
32+
33+
34+
@Test
35+
public void filename() throws Exception {
36+
37+
StandardMultipartHttpServletRequest request = getRequest(
38+
"file", "form-data; name=\"file\"; filename=\"myFile.txt\"");
39+
40+
MultipartFile multipartFile = request.getFile("file");
41+
assertNotNull(multipartFile);
42+
assertEquals("myFile.txt", multipartFile.getOriginalFilename());
43+
}
44+
45+
@Test // SPR-13319
46+
public void filenameRfc5987() throws Exception {
47+
48+
StandardMultipartHttpServletRequest request = getRequest(
49+
"file", "form-data; name=\"file\"; filename*=\"UTF-8''foo-%c3%a4-%e2%82%ac.html\"");
50+
51+
MultipartFile multipartFile = request.getFile("file");
52+
assertNotNull(multipartFile);
53+
assertEquals("foo-ä-€.html", multipartFile.getOriginalFilename());
54+
}
55+
56+
@Test // SPR-15205
57+
public void filenameRfc2047() throws Exception {
58+
59+
StandardMultipartHttpServletRequest request = getRequest(
60+
"file", "form-data; name=\"file\"; filename=\"=?UTF-8?Q?Declara=C3=A7=C3=A3o.pdf?=\"");
61+
62+
MultipartFile multipartFile = request.getFile("file");
63+
assertNotNull(multipartFile);
64+
assertEquals("Declaração.pdf", multipartFile.getOriginalFilename());
65+
}
66+
67+
68+
private StandardMultipartHttpServletRequest getRequest(String name, String dispositionValue) {
69+
MockHttpServletRequest request = new MockHttpServletRequest();
70+
MockPart part = new MockPart(name, new byte[0]);
71+
part.getHeaders().set("Content-Disposition", dispositionValue);
72+
request.addPart(part);
73+
return new StandardMultipartHttpServletRequest(request);
74+
}
75+
76+
}

‎spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/method/annotation/RequestPartIntegrationTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,7 @@ public ResponseEntity<Object> create(@RequestPart(name = "json-data") TestData t
249249

250250
@RequestMapping(value = "/spr13319", method = POST, consumes = "multipart/form-data")
251251
public ResponseEntity<Void> create(@RequestPart("file") MultipartFile multipartFile) {
252-
assertEquals("%C3%A9l%C3%A8ve.txt", multipartFile.getOriginalFilename());
252+
assertEquals("élève.txt", multipartFile.getOriginalFilename());
253253
return ResponseEntity.ok().build();
254254
}
255255
}

0 commit comments

Comments
 (0)