Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Improve decoding support for multipart filename

Browse Source 
StandardMultipartHttpServletRequest now properly decodes RFC-5987
encoded filenames (i.e. filename*) by delegating to ContentDisposition
and also support RFC-2047 syntax through javax.mail MimeUtility.

Issue: SPR-15205
This commit is contained in:
Rossen Stoyanchev
2017-07-20 14:21:10 +02:00
parent 2437500cfe
commit bb684ce60b
3 changed files with 102 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
spring-web/src/main/java/org/springframework/web/multipart/support/StandardMultipartHttpServletRequest.java
View File

@@ -20,8 +20,7 @@ import java.io.File;
import java.io.IOException;
import java.io.InputStream;
import java.io.Serializable;
import java.nio.charset.Charset;
import java.nio.charset.StandardCharsets;
import java.io.UnsupportedEncodingException;
import java.nio.file.Files;
import java.util.ArrayList;
import java.util.Collection;
@@ -31,9 +30,11 @@ import java.util.LinkedHashMap;
import java.util.LinkedHashSet;
import java.util.Map;
import java.util.Set;
import javax.mail.internet.MimeUtility;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.Part;
import org.springframework.http.ContentDisposition;
import org.springframework.http.HttpHeaders;
import org.springframework.lang.Nullable;
import org.springframework.util.FileCopyUtils;
@@ -54,13 +55,6 @@ import org.springframework.web.multipart.MultipartFile;
*/
public class StandardMultipartHttpServletRequest extends AbstractMultipartHttpServletRequest {
private static final String CONTENT_DISPOSITION = "content-disposition";
private static final String FILENAME_KEY = "filename=";
private static final String FILENAME_WITH_CHARSET_KEY = "filename*=";
@Nullable
private Set<String> multipartParameterNames;
@@ -96,12 +90,13 @@ public class StandardMultipartHttpServletRequest extends AbstractMultipartHttpSe
this.multipartParameterNames = new LinkedHashSet<>(parts.size());
MultiValueMap<String, MultipartFile> files = new LinkedMultiValueMap<>(parts.size());
for (Part part : parts) {
String disposition = part.getHeader(CONTENT_DISPOSITION);
String filename = extractFilename(disposition);
if (filename == null) {
filename = extractFilenameWithCharset(disposition);
}
String headerValue = part.getHeader(HttpHeaders.CONTENT_DISPOSITION);
ContentDisposition disposition = ContentDisposition.parse(headerValue);
String filename = disposition.getFilename();
if (filename != null) {
if (filename.startsWith("=?") && filename.endsWith("?=")) {
filename = MimeDelegate.decode(filename);
}
files.add(part.getName(), new StandardMultipartFile(part, filename));
}
else {
@@ -123,62 +118,6 @@ public class StandardMultipartHttpServletRequest extends AbstractMultipartHttpSe
throw new MultipartException("Failed to parse multipart servlet request", ex);
}
@Nullable
private String extractFilename(String contentDisposition, String key) {
int startIndex = contentDisposition.indexOf(key);
if (startIndex == -1) {
return null;
}
String filename = contentDisposition.substring(startIndex + key.length());
if (filename.startsWith("\"")) {
int endIndex = filename.indexOf("\"", 1);
if (endIndex != -1) {
return filename.substring(1, endIndex);
}
}
else {
int endIndex = filename.indexOf(";");
if (endIndex != -1) {
return filename.substring(0, endIndex);
}
}
return filename;
}
@Nullable
private String extractFilename(String contentDisposition) {
return extractFilename(contentDisposition, FILENAME_KEY);
}
@Nullable
private String extractFilenameWithCharset(String contentDisposition) {
String filename = extractFilename(contentDisposition, FILENAME_WITH_CHARSET_KEY);
if (filename == null) {
return null;
}
int index = filename.indexOf("'");
if (index != -1) {
Charset charset = null;
try {
charset = Charset.forName(filename.substring(0, index));
}
catch (IllegalArgumentException ex) {
// ignore
}
filename = filename.substring(index + 1);
// Skip language information..
index = filename.indexOf("'");
if (index != -1) {
filename = filename.substring(index + 1);
}
if (charset != null) {
filename = new String(filename.getBytes(StandardCharsets.US_ASCII), charset);
}
}
return filename;
}
@Override
protected void initializeMultipart() {
parseRequest(getRequest());
@@ -322,4 +261,20 @@ public class StandardMultipartHttpServletRequest extends AbstractMultipartHttpSe
}
}
/**
* Inner class to avoid a hard dependency on the JavaMail API.
*/
private static class MimeDelegate {
public static String decode(String value) {
try {
return MimeUtility.decodeText(value);
}
catch (UnsupportedEncodingException ex) {
throw new IllegalStateException(ex);
}
}
}
}