From 46c1b91d72e4de81e091f5245b415aaafbc3cf0b Mon Sep 17 00:00:00 2001
From: Alhuda Khan <al.hudz.k@gmail.com>
Date: Sun, 12 Jul 2026 02:40:14 +0530
Subject: [PATCH] Reject truncated percent-encoding in RFC2231Utils.decodeText

---
 .../org/apache/commons/fileupload2/core/RFC2231Utils.java   | 3 ++-
 .../commons/fileupload2/core/RFC2231UtilityTestCase.java    | 6 ++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/RFC2231Utils.java b/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/RFC2231Utils.java
index 73f415cb9..3d8c9da03 100644
--- a/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/RFC2231Utils.java
+++ b/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/RFC2231Utils.java
@@ -130,7 +130,8 @@ private static byte[] fromHex(final String text) {
             final var c = text.charAt(i++);
             if (c == '%') {
                 if (i > text.length() - 2) {
-                    break; // unterminated sequence
+                    // A '%' that is not followed by two hex digits is a truncated escape sequence.
+                    throw new IllegalArgumentException();
                 }
                 final var c1 = text.charAt(i++);
                 final var c2 = text.charAt(i++);
diff --git a/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/RFC2231UtilityTestCase.java b/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/RFC2231UtilityTestCase.java
index bd04552f2..7e970f43a 100644
--- a/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/RFC2231UtilityTestCase.java
+++ b/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/RFC2231UtilityTestCase.java
@@ -51,6 +51,12 @@ void testDecodeInvalidPercentEncoded() throws Exception {
         assertThrows(IllegalArgumentException.class, () -> RFC2231Utils.decodeText("ISO-8859-1''hello%3\u8a35"));
     }
 
+    @Test
+    void testDecodeTruncatedPercentEncoded() throws Exception {
+        assertThrows(IllegalArgumentException.class, () -> RFC2231Utils.decodeText("ISO-8859-1''hello%"));
+        assertThrows(IllegalArgumentException.class, () -> RFC2231Utils.decodeText("ISO-8859-1''hello%3"));
+    }
+
     @Test
     void testDecodeIso88591() throws Exception {
         assertEncoded("\u00A3 rate", "iso-8859-1'en'%A3%20rate"); // "£ rate"