struts-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (WW-4818) Default Multipart validation regex is invalid
Date Tue, 25 Jul 2017 12:35:01 GMT

    [ https://issues.apache.org/jira/browse/WW-4818?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16099968#comment-16099968
] 

ASF GitHub Bot commented on WW-4818:
------------------------------------

Github user sdutry commented on the issue:

    https://github.com/apache/struts/pull/151
  
    @lukaszlenart 
    I added 2 simple tests.
    - one containing all the special allowed characters
    - another one containing a single not-allowed character
    
    Please feel free to tell me what other test-cases you want added.
    (for example, any specific characters you want tested?)


> Default Multipart validation regex is invalid
> ---------------------------------------------
>
>                 Key: WW-4818
>                 URL: https://issues.apache.org/jira/browse/WW-4818
>             Project: Struts 2
>          Issue Type: Bug
>    Affects Versions: 2.5.12
>            Reporter: adam brin
>             Fix For: 2.5.13
>
>
> 2.5.12 introduced a regex matches for multipart requests.  The default regex used, however
is significantly too strict based on the RFC, as well as common practice.  Specifically, at
minimum, it needs to include the *hyphen* and more likely needs to support all of the fields
defined by the RFC (https://www.w3.org/Protocols/rfc1341/7_2_Multipart.html).
> {quote}bcharsnospace := DIGIT / ALPHA / "'" / "(" / ")" / "+" / "_" / "," / "-" / "."
/ "/" / ":" / "=" / "?"{quote}
> In basic testing, we've seen:
> {code} Content-Type: multipart/form-data; boundary=BRKIypZ3Stvuclu7C-CTbP2fNljGAOVk[\r][\n]{code}
(generated by the Apache HttpClient)
> and
> {code}multipart/form-data; boundary=----WebKitFormBoundaryZGDtABnGWGozLAjh{code} (generated
by Safari)



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

Mime
View raw message