andreacavalli/netty5
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix indexOutOfBoundsException when multipart/form-data is incorrect value (#9688)

Browse Source 
Motivation:

HttpPostRequestDecoder.splitHeaderContentType() throws a StringIndexOutOfBoundsException when it parses a Content-Type header that starts with a semicolon ;. We should skip the execution for incorrect multipart form data.


Modification:

Avoid invocation of HttpPostRequestDecoder#splitHeaderContentType(...) for incorrect multipart form data content-type.

Result:

Fixes #8554
This commit is contained in:
Andrey Mizurov 2019-10-23 10:03:20 +03:00 committed by Norman Maurer
parent c9c290019e
commit b17371c198
2 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostRequestDecoder.java
View File

@ -136,11 +136,11 @@ public class HttpPostRequestDecoder implements InterfaceHttpPostRequestDecoder {
* @return True if the request is a Multipart request
*/
public static boolean isMultipart(HttpRequest request) {
if (request.headers().contains(HttpHeaderNames.CONTENT_TYPE)) {
return getMultipartDataBoundary(request.headers().get(HttpHeaderNames.CONTENT_TYPE)) != null;
} else {
return false;
String mimeType = request.headers().get(HttpHeaderNames.CONTENT_TYPE);
if (mimeType != null && mimeType.startsWith(HttpHeaderValues.MULTIPART_FORM_DATA.toString())) {
return getMultipartDataBoundary(mimeType) != null;
}
return false;
}
/**

14
codec-http/src/test/java/io/netty/handler/codec/http/multipart/HttpPostRequestDecoderTest.java
View File

@ -29,6 +29,7 @@ import io.netty.handler.codec.http.HttpContent;
import io.netty.handler.codec.http.HttpHeaderNames;
import io.netty.handler.codec.http.HttpHeaderValues;
import io.netty.handler.codec.http.HttpMethod;
import io.netty.handler.codec.http.HttpRequest;
import io.netty.handler.codec.http.HttpVersion;
import io.netty.handler.codec.http.LastHttpContent;
import io.netty.util.CharsetUtil;
@ -734,4 +735,17 @@ public class HttpPostRequestDecoderTest {
assertTrue(request.release());
}
}
@Test
public void testMultipartFormDataContentType() {
HttpRequest request = new DefaultHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.POST, "/");
assertFalse(HttpPostRequestDecoder.isMultipart(request));
String multipartDataValue = HttpHeaderValues.MULTIPART_FORM_DATA + ";" + "boundary=gc0p4Jq0M2Yt08jU534c0p";
request.headers().set(HttpHeaderNames.CONTENT_TYPE, ";" + multipartDataValue);
assertFalse(HttpPostRequestDecoder.isMultipart(request));
request.headers().set(HttpHeaderNames.CONTENT_TYPE, multipartDataValue);
assertTrue(HttpPostRequestDecoder.isMultipart(request));
}
}