diff --git a/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/MimeUtils.java b/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/MimeUtils.java index 0cd0e8473..0ab0a50f3 100644 --- a/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/MimeUtils.java +++ b/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/MimeUtils.java @@ -235,7 +235,9 @@ private static String decodeWord(final String word) throws ParseException, Unsup // get the decoded byte data and convert into a string. final var decodedData = out.toByteArray(); return new String(decodedData, javaCharset(charset)); - } catch (final IOException e) { + } catch (final IOException | IllegalArgumentException e) { + // IllegalArgumentException is thrown by the Base64 decoder on a malformed final unit; treat it like a + // quoted-printable decode failure so both encodings reject malformed input the same way. throw new UnsupportedEncodingException("Invalid RFC 2047 encoding"); } } diff --git a/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/MimeUtilityTestCase.java b/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/MimeUtilityTestCase.java index 62867c5d3..e6176e823 100644 --- a/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/MimeUtilityTestCase.java +++ b/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/MimeUtilityTestCase.java @@ -32,6 +32,13 @@ private static void assertEncoded(final String expected, final String encoded) t assertEquals(expected, MimeUtils.decodeText(encoded)); } + @Test + void testDecodeInvalidBase64() { + // A base64 payload whose final unit is truncated ("A" is a single base64 char) is rejected the same way as a + // malformed quoted-printable payload, rather than leaking an IllegalArgumentException from the base64 decoder. + assertThrows(UnsupportedEncodingException.class, () -> MimeUtils.decodeText("=?UTF-8?B?A?=")); + } + @Test void testDecodeInvalidEncoding() { assertThrows(UnsupportedEncodingException.class, () -> MimeUtils.decodeText("=?invalid?B?xyz-?="));