From b5de8bc18d652331f505d0fa9c3b14518f337184 Mon Sep 17 00:00:00 2001 From: Alhuda Khan Date: Wed, 15 Jul 2026 21:28:51 +0530 Subject: [PATCH] reject malformed base64 payload in RFC 2047 decodeWord --- .../org/apache/commons/fileupload2/core/MimeUtils.java | 4 +++- .../commons/fileupload2/core/MimeUtilityTestCase.java | 7 +++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/MimeUtils.java b/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/MimeUtils.java index 0cd0e8473..0ab0a50f3 100644 --- a/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/MimeUtils.java +++ b/commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/MimeUtils.java @@ -235,7 +235,9 @@ private static String decodeWord(final String word) throws ParseException, Unsup // get the decoded byte data and convert into a string. final var decodedData = out.toByteArray(); return new String(decodedData, javaCharset(charset)); - } catch (final IOException e) { + } catch (final IOException | IllegalArgumentException e) { + // IllegalArgumentException is thrown by the Base64 decoder on a malformed final unit; treat it like a + // quoted-printable decode failure so both encodings reject malformed input the same way. throw new UnsupportedEncodingException("Invalid RFC 2047 encoding"); } } diff --git a/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/MimeUtilityTestCase.java b/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/MimeUtilityTestCase.java index 62867c5d3..e6176e823 100644 --- a/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/MimeUtilityTestCase.java +++ b/commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/MimeUtilityTestCase.java @@ -32,6 +32,13 @@ private static void assertEncoded(final String expected, final String encoded) t assertEquals(expected, MimeUtils.decodeText(encoded)); } + @Test + void testDecodeInvalidBase64() { + // A base64 payload whose final unit is truncated ("A" is a single base64 char) is rejected the same way as a + // malformed quoted-printable payload, rather than leaking an IllegalArgumentException from the base64 decoder. + assertThrows(UnsupportedEncodingException.class, () -> MimeUtils.decodeText("=?UTF-8?B?A?=")); + } + @Test void testDecodeInvalidEncoding() { assertThrows(UnsupportedEncodingException.class, () -> MimeUtils.decodeText("=?invalid?B?xyz-?="));