fix: use correct character encoding when parsing of MIME parameter value

[t4nmoy]

Hello, I'm proposing fixes for MIME4J-109. As suggested pull64 is closed and this one is created based on the code review. please let me know if any clarification is needed. Thanks

[chibenwa]

Can we get this test too for the lenient version?

[t4nmoy]

sure thing, but are suggesting to move this test to LenientContentDispositionFieldTest or just replicate the same test in LenientContentDispositionFieldTest?

[chibenwa]

Replicate in my opinion.

The best way to go in the future is to have a common "contract" for both the lenient and non lenient implementations but this clearly looks like another topic to me.

[t4nmoy]

yes, I agree with you

[chibenwa]

👍 sorry for messing up.

I was about to fix it....

[chibenwa]

Fuzzing:

== Java Exception: java.lang.NullPointerException
	at org.apache.james.mime4j.util.MimeParameterMapping.decodeParameterValue(MimeParameterMapping.java:48)
	at org.apache.james.mime4j.util.MimeParameterMapping.getParameters(MimeParameterMapping.java:33)
	at org.apache.james.mime4j.field.ContentDispositionFieldLenientImpl.parse(ContentDispositionFieldLenientImpl.java:176)
	at org.apache.james.mime4j.field.ContentDispositionFieldLenientImpl.getParameter(ContentDispositionFieldLenientImpl.java:87)
	at org.apache.james.mime4j.field.ContentDispositionFieldLenientImpl.getFilename(ContentDispositionFieldLenientImpl.java:121)
	at DJazzer.fuzzerTestOneInput(DJazzer.java:31)

Input: (in base64)

Owo8PA==

Not encoded:

;
<<

Code of the Fuzzer:

import java.util.Base64;

import org.apache.james.mime4j.codec.DecodeMonitor;
import org.apache.james.mime4j.dom.field.ContentDispositionField;
import org.apache.james.mime4j.field.ContentDispositionFieldLenientImpl;
import org.apache.james.mime4j.stream.RawField;

import com.code_intelligence.jazzer.api.FuzzedDataProvider;

public class DJazzer {
    public static void fuzzerTestOneInput(FuzzedDataProvider data) {
        final String body = data.consumeAsciiString(1024);
        try {
            final ContentDispositionField parse = ContentDispositionFieldLenientImpl.PARSER.parse(
                new RawField("Content-Disposition", body), DecodeMonitor.SILENT);
            parse.getFilename();
        } catch (Exception e) {
            e.printStackTrace();
            System.out.println(Base64.getEncoder().encodeToString(body.getBytes()));
            throw e;
        }
    }
}

Runned with jazzer and a big fat jar with dependencies.

[andreak]

Does this need any further reviewing before merging?

[chibenwa]

Does this need any further reviewing before merging?

No we are good. Letting a little more time for people to review (~a week) is generally seen as a good practice within the ASF. Sorry for loosing track of this topic ;-)