Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Escape quotes in filename

Browse Source 
Closes gh-24220
This commit is contained in:
Rossen Stoyanchev
2019-12-19 12:23:12 +00:00
parent 44da775134
commit 41f40c6c22
2 changed files with 80 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

79
spring-web/src/test/java/org/springframework/http/ContentDispositionTests.java
View File

@@ -19,11 +19,13 @@ package org.springframework.http;
import java.nio.charset.StandardCharsets;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import java.util.function.BiConsumer;
import org.junit.jupiter.api.Test;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
import static org.springframework.http.ContentDisposition.builder;
/**
* Unit tests for {@link ContentDisposition}
@@ -38,7 +40,7 @@ public class ContentDispositionTests {
@Test
public void parse() {
assertThat(parse("form-data; name=\"foo\"; filename=\"foo.txt\"; size=123"))
.isEqualTo(ContentDisposition.builder("form-data")
.isEqualTo(builder("form-data")
.name("foo")
.filename("foo.txt")
.size(123L)
@@ -48,7 +50,7 @@ public class ContentDispositionTests {
@Test
public void parseFilenameUnquoted() {
assertThat(parse("form-data; filename=unquoted"))
.isEqualTo(ContentDisposition.builder("form-data")
.isEqualTo(builder("form-data")
.filename("unquoted")
.build());
}
@@ -56,7 +58,7 @@ public class ContentDispositionTests {
@Test // SPR-16091
public void parseFilenameWithSemicolon() {
assertThat(parse("attachment; filename=\"filename with ; semicolon.txt\""))
.isEqualTo(ContentDisposition.builder("attachment")
.isEqualTo(builder("attachment")
.filename("filename with ; semicolon.txt")
.build());
}
@@ -64,7 +66,7 @@ public class ContentDispositionTests {
@Test
public void parseEncodedFilename() {
assertThat(parse("form-data; name=\"name\"; filename*=UTF-8''%E4%B8%AD%E6%96%87.txt"))
.isEqualTo(ContentDisposition.builder("form-data")
.isEqualTo(builder("form-data")
.name("name")
.filename("中文.txt", StandardCharsets.UTF_8)
.build());
@@ -73,7 +75,7 @@ public class ContentDispositionTests {
@Test // gh-24112
public void parseEncodedFilenameWithPaddedCharset() {
assertThat(parse("attachment; filename*= UTF-8''some-file.zip"))
.isEqualTo(ContentDisposition.builder("attachment")
.isEqualTo(builder("attachment")
.filename("some-file.zip", StandardCharsets.UTF_8)
.build());
}
@@ -81,7 +83,7 @@ public class ContentDispositionTests {
@Test
public void parseEncodedFilenameWithoutCharset() {
assertThat(parse("form-data; name=\"name\"; filename*=test.txt"))
.isEqualTo(ContentDisposition.builder("form-data")
.isEqualTo(builder("form-data")
.name("name")
.filename("test.txt")
.build());
@@ -104,18 +106,30 @@ public class ContentDispositionTests {
@Test // gh-23077
public void parseWithEscapedQuote() {
assertThat(parse("form-data; name=\"file\"; filename=\"\\\"The Twilight Zone\\\".txt\"; size=123"))
.isEqualTo(ContentDisposition.builder("form-data")
.name("file")
.filename("\\\"The Twilight Zone\\\".txt")
.size(123L)
.build());
BiConsumer<String, String> tester = (description, filename) -> {
assertThat(parse("form-data; name=\"file\"; filename=\"" + filename + "\"; size=123"))
.as(description)
.isEqualTo(builder("form-data").name("file").filename(filename).size(123L).build());
};
tester.accept("Escaped quotes should be ignored",
"\\\"The Twilight Zone\\\".txt");
tester.accept("Escaped quotes preceded by escaped backslashes should be ignored",
"\\\\\\\"The Twilight Zone\\\\\\\".txt");
tester.accept("Escaped backslashes should not suppress quote",
"The Twilight Zone \\\\");
tester.accept("Escaped backslashes should not suppress quote",
"The Twilight Zone \\\\\\\\");
}
@Test
public void parseWithExtraSemicolons() {
assertThat(parse("form-data; name=\"foo\";; ; filename=\"foo.txt\"; size=123"))
.isEqualTo(ContentDisposition.builder("form-data")
.isEqualTo(builder("form-data")
.name("foo")
.filename("foo.txt")
.size(123L)
@@ -133,7 +147,7 @@ public class ContentDispositionTests {
"creation-date=\"" + creationTime.format(formatter) + "\"; " +
"modification-date=\"" + modificationTime.format(formatter) + "\"; " +
"read-date=\"" + readTime.format(formatter) + "\"")).isEqualTo(
ContentDisposition.builder("attachment")
builder("attachment")
.creationDate(creationTime)
.modificationDate(modificationTime)
.readDate(readTime)
@@ -149,7 +163,7 @@ public class ContentDispositionTests {
"creation-date=\"-1\"; " +
"modification-date=\"-1\"; " +
"read-date=\"" + readTime.format(formatter) + "\"")).isEqualTo(
ContentDisposition.builder("attachment")
builder("attachment")
.readDate(readTime)
.build());
}
@@ -177,7 +191,7 @@ public class ContentDispositionTests {
@Test
public void format() {
assertThat(
ContentDisposition.builder("form-data")
builder("form-data")
.name("foo")
.filename("foo.txt")
.size(123L)
@@ -188,7 +202,7 @@ public class ContentDispositionTests {
@Test
public void formatWithEncodedFilename() {
assertThat(
ContentDisposition.builder("form-data")
builder("form-data")
.name("name")
.filename("中文.txt", StandardCharsets.UTF_8)
.build().toString())
@@ -198,7 +212,7 @@ public class ContentDispositionTests {
@Test
public void formatWithEncodedFilenameUsingUsAscii() {
assertThat(
ContentDisposition.builder("form-data")
builder("form-data")
.name("name")
.filename("test.txt", StandardCharsets.US_ASCII)
.build()
@@ -206,10 +220,37 @@ public class ContentDispositionTests {
.isEqualTo("form-data; name=\"name\"; filename=\"test.txt\"");
}
@Test // gh-24220
public void formatWithFilenameWithQuotes() {
BiConsumer<String, String> tester = (input, output) -> {
assertThat(builder("form-data").filename(input).build().toString())
.isEqualTo("form-data; filename=\"" + output + "\"");
};
String filename = "\"foo.txt";
tester.accept(filename, "\\" + filename);
filename = "\\\"foo.txt";
tester.accept(filename, filename);
filename = "\\\\\"foo.txt";
tester.accept(filename, "\\" + filename);
filename = "\\\\\\\"foo.txt";
tester.accept(filename, filename);
filename = "\\\\\\\\\"foo.txt";
tester.accept(filename, "\\" + filename);
tester.accept("\"\"foo.txt", "\\\"\\\"foo.txt");
tester.accept("\"\"\"foo.txt", "\\\"\\\"\\\"foo.txt");
}
@Test
public void formatWithEncodedFilenameUsingInvalidCharset() {
assertThatIllegalArgumentException().isThrownBy(() ->
ContentDisposition.builder("form-data")
builder("form-data")
.name("name")
.filename("test.txt", StandardCharsets.UTF_16)
.build()