Skip to content

Match RFC 2047 encoding token case-insensitively in decodeWord#476

Merged
garydgregory merged 1 commit into
apache:masterfrom
alhudz:rfc2047-encoding-case
Jul 13, 2026
Merged

Match RFC 2047 encoding token case-insensitively in decodeWord#476
garydgregory merged 1 commit into
apache:masterfrom
alhudz:rfc2047-encoding-case

Conversation

@alhudz

@alhudz alhudz commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

Repro: Content-Disposition: attachment; filename="=?utf-8?b?ZXZpbC5leGU=?=", a valid RFC 2047 encoded-word that uses the lower-case b marker.
Expected: the filename decodes to evil.exe, matching the upper-case =?utf-8?B?...?= form.
Actual: MimeUtils.decodeWord throws UnsupportedEncodingException, so ParameterParser keeps the raw value =?utf-8?b?ZXZpbC5leGU=?=. Lower-case q behaves the same way against the Q marker.
Cause: the charset token is lower-cased before use, but the encoding token is compared case-sensitively with encoding.equals("B") / equals("Q"). RFC 2047 section 2 defines the encoding as case-independent (b == B, q == Q).
Fix: compare the encoding token with equalsIgnoreCase, so b/q decode identically to B/Q. Two regression tests cover the lower-case base64 and quoted-printable markers; both fail before the change.

  • Read the contribution guidelines for this project.
  • Read the ASF Generative Tooling Guidance if you use Artificial Intelligence (AI).
  • I used AI to create any part of, or all of, this pull request. Which AI tool was used to create this pull request, and to what extent did it contribute?
  • Run a successful build using the default Maven goal with mvn; that's mvn on the command line by itself.
  • Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible, but it is a best practice.
  • Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
  • Each commit in the pull request should have a meaningful subject line and body. Note that a maintainer may squash commits during the merge process.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes RFC 2047 “encoded-word” decoding in MimeUtils.decodeWord by treating the encoding token (B/Q) case-insensitively, ensuring lower-case markers (b/q) decode correctly (e.g., for Content-Disposition filenames).

Changes:

  • Update decodeWord to compare the encoding token using equalsIgnoreCase for both Base64 (B) and quoted-printable (Q).
  • Add regression tests covering lower-case b and q encoding markers.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/MimeUtils.java Makes RFC 2047 encoding token matching case-insensitive in decodeWord.
commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/MimeUtilityTestCase.java Adds tests to verify lower-case b/q markers decode correctly.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.


// Base64 encoded?
if (encoding.equals(BASE64_ENCODING_MARKER)) {
// Base64 encoded? RFC 2047 section 2 defines the encoding token as case-independent, so 'b' and 'q' are also valid.
@garydgregory
garydgregory merged commit b44c5e8 into apache:master Jul 13, 2026
9 checks passed
@garydgregory

Copy link
Copy Markdown
Member

@alhudz Merged 🚀 Thank you, please port to 1.x.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants