Skip to content

Commit

Permalink
Changed are now formatted correctly
Browse files Browse the repository at this point in the history
  • Loading branch information
alexdboxall committed Nov 7, 2023
1 parent 0f52f34 commit f17efd2
Show file tree
Hide file tree
Showing 2 changed files with 24 additions and 14 deletions.
14 changes: 8 additions & 6 deletions core/play/src/main/java/play/mvc/Http.java
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,9 @@
import java.net.URLEncoder;
import java.nio.charset.Charset;
import java.nio.charset.StandardCharsets;
import java.nio.file.InvalidPathException;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.nio.file.InvalidPathException;
import java.security.cert.X509Certificate;
import java.time.Duration;
import java.util.*;
Expand Down Expand Up @@ -1502,7 +1502,9 @@ public String getKey() {
return key;
}

/** @return the sanitized version of the file name (i.e. only the filename, no path components) */
/**
* @return the sanitized version of the file name (i.e. only the filename, no path components)
*/
public String getSanitizedFilename() {
try {
// Will throw InvalidPathException on invalid filepaths
Expand All @@ -1516,13 +1518,13 @@ public String getSanitizedFilename() {

} catch (InvalidPathException e) {
throw new RuntimeException(
"Unable to sanitize the filename given to MultipartFormData.FilePart: \""
+ e.getInput()
+ "\"");
"Unable to sanitize the filename given to MultipartFormData.FilePart: \""
+ e.getInput()
+ "\"");
}
}

/**
/**
* @deprecated Use {@link #getSanitizedFilename()} instead.
* @return the raw file name
*/
Expand Down
24 changes: 16 additions & 8 deletions core/play/src/test/java/play/mvc/SanitizedFilenameTest.java
Original file line number Diff line number Diff line change
Expand Up @@ -12,43 +12,50 @@
public class SanitizedFilenameTest {
@Test
public void sanitizeSingleComponent() {
MultipartFormData.FilePart<Object> p = new MultipartFormData.FilePart<Object>(null, "abc", null, null);
MultipartFormData.FilePart<Object> p =
new MultipartFormData.FilePart<Object>(null, "abc", null, null);
assertEquals("abc", p.getSanitizedFilename());
}

@Test
public void sanitizeMultipleComponents() {
MultipartFormData.FilePart<Object> p = new MultipartFormData.FilePart<Object>(null, "abc/def/xyz", null, null);
MultipartFormData.FilePart<Object> p =
new MultipartFormData.FilePart<Object>(null, "abc/def/xyz", null, null);
assertEquals("xyz", p.getSanitizedFilename());
}

@Test
public void sanitizeWithTrailingDots() {
MultipartFormData.FilePart<Object> p = new MultipartFormData.FilePart<Object>(null, "a/b/c/././", null, null);
MultipartFormData.FilePart<Object> p =
new MultipartFormData.FilePart<Object>(null, "a/b/c/././", null, null);
assertEquals("c", p.getSanitizedFilename());
}

@Test
public void sanitizeWithLeadingDoubleDots() {
MultipartFormData.FilePart<Object> p = new MultipartFormData.FilePart<Object>(null, "../../../a", null, null);
MultipartFormData.FilePart<Object> p =
new MultipartFormData.FilePart<Object>(null, "../../../a", null, null);
assertEquals("a", p.getSanitizedFilename());
}

@Test
public void sanitizeWithNameAfterDoubleDots() {
MultipartFormData.FilePart<Object> p = new MultipartFormData.FilePart<Object>(null, "../../../a/../b", null, null);
MultipartFormData.FilePart<Object> p =
new MultipartFormData.FilePart<Object>(null, "../../../a/../b", null, null);
assertEquals("b", p.getSanitizedFilename());
}

@Test
public void sanitizeWithTrailingDoubleDots() {
MultipartFormData.FilePart<Object> p = new MultipartFormData.FilePart<Object>(null, "a/b/c/../..", null, null);
MultipartFormData.FilePart<Object> p =
new MultipartFormData.FilePart<Object>(null, "a/b/c/../..", null, null);
assertEquals("a", p.getSanitizedFilename());
}

@Test
public void sanitizeWithRedundantSlashesAndDots() {
MultipartFormData.FilePart<Object> p = new MultipartFormData.FilePart<Object>(null, "///a//b/c/.././d/././/", null, null);
MultipartFormData.FilePart<Object> p =
new MultipartFormData.FilePart<Object>(null, "///a//b/c/.././d/././/", null, null);
assertEquals("d", p.getSanitizedFilename());
}

Expand All @@ -69,7 +76,8 @@ public void sanitizeThrowsOnDoubleDots() {

@Test(expected = RuntimeException.class)
public void sanitizeThrowsPastRoot() {
(new MultipartFormData.FilePart<Object>(null, "a/b/../../..", null, null)).getSanitizedFilename();
(new MultipartFormData.FilePart<Object>(null, "a/b/../../..", null, null))
.getSanitizedFilename();
}

@Test(expected = RuntimeException.class)
Expand Down

0 comments on commit f17efd2

Please sign in to comment.