From 82adbcb87a256a5384ee7e8725953a9692708809 Mon Sep 17 00:00:00 2001
From: Basil Crow <me@basilcrow.com>
Date: Tue, 14 May 2024 16:39:24 -0700
Subject: [PATCH] [JENKINS-73170] Upgrade Commons FileUpload from 1.5 to
 2.0.0-M2

---
 core/pom.xml                                  |  40 +-
 .../apache/commons/fileupload/FileItem.java   | 438 ++++++++++++++++++
 .../commons/fileupload/FileItemHeaders.java   | 121 +++++
 .../fileupload/InvalidFileNameException.java  |  61 +++
 .../java/org/kohsuke/stapler/RequestImpl.java |  43 +-
 .../java/org/kohsuke/stapler/Stapler.java     |  16 +-
 .../org/kohsuke/stapler/StaplerRequest.java   |   4 +-
 .../org/kohsuke/stapler/RequestImplTest.java  |   2 +-
 8 files changed, 701 insertions(+), 24 deletions(-)
 create mode 100644 core/src/main/java/org/apache/commons/fileupload/FileItem.java
 create mode 100644 core/src/main/java/org/apache/commons/fileupload/FileItemHeaders.java
 create mode 100644 core/src/main/java/org/apache/commons/fileupload/InvalidFileNameException.java

diff --git a/core/pom.xml b/core/pom.xml
index 912ec1f1c..946c1d1da 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -10,7 +10,18 @@
   <artifactId>stapler</artifactId>
   <name>Stapler</name>
   <description>Stapler HTTP request handling engine</description>
+
+  <properties>
+    <bridge-method-injector.version>1.29</bridge-method-injector.version>
+    <commons-fileupload2.version>2.0.0-M2</commons-fileupload2.version>
+  </properties>
+
   <dependencies>
+    <dependency>
+      <groupId>com.infradna.tool</groupId>
+      <artifactId>bridge-method-annotation</artifactId>
+      <version>${bridge-method-injector.version}</version>
+    </dependency>
     <dependency>
       <groupId>com.jcraft</groupId>
       <artifactId>jzlib</artifactId>
@@ -38,12 +49,6 @@
       <artifactId>commons-discovery</artifactId>
       <version>0.5</version>
     </dependency>
-    <dependency>
-      <!-- perhaps mark this dependency optional? -->
-      <groupId>commons-fileupload</groupId>
-      <artifactId>commons-fileupload</artifactId>
-      <version>1.5</version>
-    </dependency>
     <dependency>
       <groupId>commons-io</groupId>
       <artifactId>commons-io</artifactId>
@@ -63,6 +68,17 @@
       <artifactId>javax.annotation-api</artifactId>
       <version>1.3.2</version>
     </dependency>
+    <!-- perhaps mark these dependencies optional? -->
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-fileupload2-core</artifactId>
+      <version>${commons-fileupload2.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-fileupload2-javax</artifactId>
+      <version>${commons-fileupload2.version}</version>
+    </dependency>
     <dependency>
       <!--
         To allow stapler to be used from Groovy, code, we have a bit of tooling
@@ -178,6 +194,18 @@
 
   <build>
     <plugins>
+      <plugin>
+        <groupId>com.infradna.tool</groupId>
+        <artifactId>bridge-method-injector</artifactId>
+        <version>${bridge-method-injector.version}</version>
+        <executions>
+          <execution>
+            <goals>
+              <goal>process</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
       <plugin>
         <artifactId>maven-jar-plugin</artifactId>
         <executions>
diff --git a/core/src/main/java/org/apache/commons/fileupload/FileItem.java b/core/src/main/java/org/apache/commons/fileupload/FileItem.java
new file mode 100644
index 000000000..d9a0268cf
--- /dev/null
+++ b/core/src/main/java/org/apache/commons/fileupload/FileItem.java
@@ -0,0 +1,438 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.fileupload;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.UncheckedIOException;
+import java.io.UnsupportedEncodingException;
+import java.nio.charset.Charset;
+import java.nio.file.Path;
+import org.apache.commons.fileupload2.core.FileItemHeadersProvider;
+
+/**
+ * <p> This class represents a file or form item that was received within a
+ * <code>multipart/form-data</code> POST request.
+ *
+ * <p> After retrieving an instance of this class from a {@code
+ * org.apache.commons.fileupload.FileUpload FileUpload} instance (see
+ * {@code org.apache.commons.fileupload.servlet.ServletFileUpload
+ * #parseRequest(javax.servlet.http.HttpServletRequest)}), you may
+ * either request all contents of the file at once using {@link #get()} or
+ * request an {@link java.io.InputStream InputStream} with
+ * {@link #getInputStream()} and process the file without attempting to load
+ * it into memory, which may come handy with large files.
+ *
+ * <p> While this interface does not extend
+ * <code>javax.activation.DataSource</code> per se (to avoid a seldom used
+ * dependency), several of the defined methods are specifically defined with
+ * the same signatures as methods in that interface. This allows an
+ * implementation of this interface to also implement
+ * <code>javax.activation.DataSource</code> with minimal additional work.
+ */
+public interface FileItem {
+
+    // ------------------------------- Methods from javax.activation.DataSource
+
+    /**
+     * Returns an {@link java.io.InputStream InputStream} that can be
+     * used to retrieve the contents of the file.
+     *
+     * @return An {@link java.io.InputStream InputStream} that can be
+     *         used to retrieve the contents of the file.
+     *
+     * @throws IOException if an error occurs.
+     */
+    InputStream getInputStream() throws IOException;
+
+    /**
+     * Returns the content type passed by the browser or <code>null</code> if
+     * not defined.
+     *
+     * @return The content type passed by the browser or <code>null</code> if
+     *         not defined.
+     */
+    String getContentType();
+
+    /**
+     * Returns the original filename in the client's filesystem, as provided by
+     * the browser (or other client software). In most cases, this will be the
+     * base file name, without path information. However, some clients, such as
+     * the Opera browser, do include path information.
+     *
+     * @return The original filename in the client's filesystem.
+     * @throws InvalidFileNameException The file name contains a NUL character,
+     *   which might be an indicator of a security attack. If you intend to
+     *   use the file name anyways, catch the exception and use
+     *   InvalidFileNameException#getName().
+     */
+    String getName();
+
+    // ------------------------------------------------------- FileItem methods
+
+    /**
+     * Provides a hint as to whether or not the file contents will be read
+     * from memory.
+     *
+     * @return <code>true</code> if the file contents will be read from memory;
+     *         <code>false</code> otherwise.
+     */
+    boolean isInMemory();
+
+    /**
+     * Returns the size of the file item.
+     *
+     * @return The size of the file item, in bytes.
+     */
+    long getSize();
+
+    /**
+     * Returns the contents of the file item as an array of bytes.
+     *
+     * @return The contents of the file item as an array of bytes.
+     */
+    byte[] get();
+
+    /**
+     * Returns the contents of the file item as a String, using the specified
+     * encoding.  This method uses {@link #get()} to retrieve the
+     * contents of the item.
+     *
+     * @param encoding The character encoding to use.
+     *
+     * @return The contents of the item, as a string.
+     *
+     * @throws UnsupportedEncodingException if the requested character
+     *                                      encoding is not available.
+     */
+    String getString(String encoding) throws UnsupportedEncodingException;
+
+    /**
+     * Returns the contents of the file item as a String, using the default
+     * character encoding.  This method uses {@link #get()} to retrieve the
+     * contents of the item.
+     *
+     * @return The contents of the item, as a string.
+     */
+    String getString();
+
+    /**
+     * A convenience method to write an uploaded item to disk. The client code
+     * is not concerned with whether or not the item is stored in memory, or on
+     * disk in a temporary location. They just want to write the uploaded item
+     * to a file.
+     * <p>
+     * This method is not guaranteed to succeed if called more than once for
+     * the same item. This allows a particular implementation to use, for
+     * example, file renaming, where possible, rather than copying all of the
+     * underlying data, thus gaining a significant performance benefit.
+     *
+     * @param file The <code>File</code> into which the uploaded item should
+     *             be stored.
+     *
+     * @throws Exception if an error occurs.
+     */
+    void write(File file) throws Exception;
+
+    /**
+     * Deletes the underlying storage for a file item, including deleting any
+     * associated temporary disk file. Although this storage will be deleted
+     * automatically when the <code>FileItem</code> instance is garbage
+     * collected, this method can be used to ensure that this is done at an
+     * earlier time, thus preserving system resources.
+     */
+    void delete();
+
+    /**
+     * Returns the name of the field in the multipart form corresponding to
+     * this file item.
+     *
+     * @return The name of the form field.
+     */
+    String getFieldName();
+
+    /**
+     * Sets the field name used to reference this file item.
+     *
+     * @param name The name of the form field.
+     */
+    void setFieldName(String name);
+
+    /**
+     * Determines whether or not a <code>FileItem</code> instance represents
+     * a simple form field.
+     *
+     * @return <code>true</code> if the instance represents a simple form
+     *         field; <code>false</code> if it represents an uploaded file.
+     */
+    boolean isFormField();
+
+    /**
+     * Specifies whether or not a <code>FileItem</code> instance represents
+     * a simple form field.
+     *
+     * @param state <code>true</code> if the instance represents a simple form
+     *              field; <code>false</code> if it represents an uploaded file.
+     */
+    void setFormField(boolean state);
+
+    /**
+     * Returns an {@link java.io.OutputStream OutputStream} that can
+     * be used for storing the contents of the file.
+     *
+     * @return An {@link java.io.OutputStream OutputStream} that can be used
+     *         for storing the contensts of the file.
+     *
+     * @throws IOException if an error occurs.
+     */
+    OutputStream getOutputStream() throws IOException;
+
+    /**
+     * Returns the collection of headers defined locally within this item.
+     *
+     * @return the {@link FileItemHeaders} present for this item.
+     */
+    FileItemHeaders getHeaders();
+
+    /**
+     * Sets the headers read from within an item.  Implementations of
+     * {@link FileItem} or {@code FileItemStream} should implement this
+     * interface to be able to get the raw headers found within the item
+     * header block.
+     *
+     * @param headers the instance that holds onto the headers
+     *         for this instance.
+     */
+    void setHeaders(FileItemHeaders headers);
+
+    default org.apache.commons.fileupload2.core.FileItem toFileUpload2FileItem() {
+        return new org.apache.commons.fileupload2.core.FileItem() {
+            @Override
+            public org.apache.commons.fileupload2.core.FileItemHeaders getHeaders() {
+                return FileItem.this.getHeaders().toFileUpload2FileItemHeaders();
+            }
+
+            @Override
+            public FileItemHeadersProvider setHeaders(org.apache.commons.fileupload2.core.FileItemHeaders headers) {
+                FileItem.this.setHeaders(FileItemHeaders.fromFileUpload2FileItemHeaders(headers));
+                return this;
+            }
+
+            @Override
+            public org.apache.commons.fileupload2.core.FileItem delete() throws IOException {
+                try {
+                    FileItem.this.delete();
+                } catch (UncheckedIOException e) {
+                    throw e.getCause();
+                }
+                return this;
+            }
+
+            @Override
+            public byte[] get() {
+                return FileItem.this.get();
+            }
+
+            @Override
+            public String getContentType() {
+                return FileItem.this.getContentType();
+            }
+
+            @Override
+            public String getFieldName() {
+                return FileItem.this.getFieldName();
+            }
+
+            @Override
+            public InputStream getInputStream() throws IOException {
+                return FileItem.this.getInputStream();
+            }
+
+            @Override
+            @SuppressFBWarnings(value = "FILE_UPLOAD_FILENAME", justification = "for compatibility")
+            public String getName() {
+                return FileItem.this.getName();
+            }
+
+            @Override
+            public OutputStream getOutputStream() throws IOException {
+                return FileItem.this.getOutputStream();
+            }
+
+            @Override
+            public long getSize() {
+                return FileItem.this.getSize();
+            }
+
+            @Override
+            public String getString() {
+                return FileItem.this.getString();
+            }
+
+            @Override
+            public String getString(Charset toCharset) throws IOException {
+                return FileItem.this.getString(toCharset.name());
+            }
+
+            @Override
+            public boolean isFormField() {
+                return FileItem.this.isFormField();
+            }
+
+            @Override
+            public boolean isInMemory() {
+                return FileItem.this.isInMemory();
+            }
+
+            @Override
+            public org.apache.commons.fileupload2.core.FileItem setFieldName(String name) {
+                FileItem.this.setFieldName(name);
+                return this;
+            }
+
+            @Override
+            public org.apache.commons.fileupload2.core.FileItem setFormField(boolean state) {
+                FileItem.this.setFormField(state);
+                return this;
+            }
+
+            @Override
+            public org.apache.commons.fileupload2.core.FileItem write(Path file) throws IOException {
+                try {
+                    FileItem.this.write(file.toFile());
+                } catch (UncheckedIOException e) {
+                    throw e.getCause();
+                } catch (IOException e) {
+                    throw e;
+                } catch (Exception e) {
+                    throw new RuntimeException(e);
+                }
+                return this;
+            }
+        };
+    }
+
+    static FileItem fromFileUpload2FileItem(org.apache.commons.fileupload2.core.FileItem from) {
+        return new FileItem() {
+
+            @Override
+            public InputStream getInputStream() throws IOException {
+                return from.getInputStream();
+            }
+
+            @Override
+            public String getContentType() {
+                return from.getContentType();
+            }
+
+            @Override
+            public String getName() {
+                return from.getName();
+            }
+
+            @Override
+            public boolean isInMemory() {
+                return from.isInMemory();
+            }
+
+            @Override
+            public long getSize() {
+                return from.getSize();
+            }
+
+            @Override
+            public byte[] get() {
+                return from.get();
+            }
+
+            @Override
+            public String getString(String encoding) throws UnsupportedEncodingException {
+                try {
+                    return from.getString(Charset.forName(encoding));
+                } catch (UnsupportedEncodingException e) {
+                    throw e;
+                } catch (IOException e) {
+                    throw new UncheckedIOException(e);
+                }
+            }
+
+            @Override
+            public String getString() {
+                return from.getString();
+            }
+
+            @Override
+            public void write(File file) throws Exception {
+                from.write(file.toPath());
+            }
+
+            @Override
+            public void delete() {
+                try {
+                    from.delete();
+                } catch (IOException e) {
+                    throw new UncheckedIOException(e);
+                }
+            }
+
+            @Override
+            public String getFieldName() {
+                return from.getFieldName();
+            }
+
+            @Override
+            @SuppressFBWarnings(value = "RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT", justification = "for compatibility")
+            public void setFieldName(String name) {
+                from.setFieldName(name);
+            }
+
+            @Override
+            public boolean isFormField() {
+                return from.isFormField();
+            }
+
+            @Override
+            @SuppressFBWarnings(value = "RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT", justification = "for compatibility")
+            public void setFormField(boolean state) {
+                from.setFormField(state);
+            }
+
+            @Override
+            public OutputStream getOutputStream() throws IOException {
+                return from.getOutputStream();
+            }
+
+            @Override
+            public FileItemHeaders getHeaders() {
+                return FileItemHeaders.fromFileUpload2FileItemHeaders(from.getHeaders());
+            }
+
+            @Override
+            public void setHeaders(FileItemHeaders headers) {
+                from.setHeaders(headers.toFileUpload2FileItemHeaders());
+            }
+
+            @Override
+            public org.apache.commons.fileupload2.core.FileItem toFileUpload2FileItem() {
+                return from;
+            }
+        };
+    }
+}
diff --git a/core/src/main/java/org/apache/commons/fileupload/FileItemHeaders.java b/core/src/main/java/org/apache/commons/fileupload/FileItemHeaders.java
new file mode 100644
index 000000000..f7ebc6f77
--- /dev/null
+++ b/core/src/main/java/org/apache/commons/fileupload/FileItemHeaders.java
@@ -0,0 +1,121 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.fileupload;
+
+import java.util.Iterator;
+
+/**
+ * <p> This class provides support for accessing the headers for a file or form
+ * item that was received within a <code>multipart/form-data</code> POST
+ * request.</p>
+ *
+ * @since 1.2.1
+ */
+public interface FileItemHeaders {
+
+    /**
+     * Returns the value of the specified part header as a <code>String</code>.
+     * <p>
+     * If the part did not include a header of the specified name, this method
+     * return <code>null</code>.  If there are multiple headers with the same
+     * name, this method returns the first header in the item.  The header
+     * name is case insensitive.
+     *
+     * @param name a <code>String</code> specifying the header name
+     * @return a <code>String</code> containing the value of the requested
+     *         header, or <code>null</code> if the item does not have a header
+     *         of that name
+     */
+    String getHeader(String name);
+
+    /**
+     * <p>
+     * Returns all the values of the specified item header as an
+     * <code>Iterator</code> of <code>String</code> objects.
+     * </p>
+     * <p>
+     * If the item did not include any headers of the specified name, this
+     * method returns an empty <code>Iterator</code>. The header name is
+     * case insensitive.
+     * </p>
+     *
+     * @param name a <code>String</code> specifying the header name
+     * @return an <code>Iterator</code> containing the values of the
+     *         requested header. If the item does not have any headers of
+     *         that name, return an empty <code>Iterator</code>
+     */
+    Iterator<String> getHeaders(String name);
+
+    /**
+     * <p>
+     * Returns an <code>Iterator</code> of all the header names.
+     * </p>
+     *
+     * @return an <code>Iterator</code> containing all of the names of
+     * headers provided with this file item. If the item does not have
+     * any headers return an empty <code>Iterator</code>
+     */
+    Iterator<String> getHeaderNames();
+
+    default org.apache.commons.fileupload2.core.FileItemHeaders toFileUpload2FileItemHeaders() {
+        return new org.apache.commons.fileupload2.core.FileItemHeaders() {
+            @Override
+            public void addHeader(String name, String value) {
+                throw new UnsupportedOperationException();
+            }
+
+            @Override
+            public String getHeader(String name) {
+                return FileItemHeaders.this.getHeader(name);
+            }
+
+            @Override
+            public Iterator<String> getHeaderNames() {
+                return FileItemHeaders.this.getHeaderNames();
+            }
+
+            @Override
+            public Iterator<String> getHeaders(String name) {
+                return FileItemHeaders.this.getHeaders(name);
+            }
+        };
+    }
+
+    static FileItemHeaders fromFileUpload2FileItemHeaders(org.apache.commons.fileupload2.core.FileItemHeaders from) {
+        return new FileItemHeaders() {
+            @Override
+            public String getHeader(String name) {
+                return from.getHeader(name);
+            }
+
+            @Override
+            public Iterator<String> getHeaders(String name) {
+                return from.getHeaders(name);
+            }
+
+            @Override
+            public Iterator<String> getHeaderNames() {
+                return from.getHeaderNames();
+            }
+
+            @Override
+            public org.apache.commons.fileupload2.core.FileItemHeaders toFileUpload2FileItemHeaders() {
+                return from;
+            }
+        };
+    }
+}
diff --git a/core/src/main/java/org/apache/commons/fileupload/InvalidFileNameException.java b/core/src/main/java/org/apache/commons/fileupload/InvalidFileNameException.java
new file mode 100644
index 000000000..49db96494
--- /dev/null
+++ b/core/src/main/java/org/apache/commons/fileupload/InvalidFileNameException.java
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.fileupload;
+
+/**
+ * This exception is thrown in case of an invalid file name.
+ * A file name is invalid, if it contains a NUL character.
+ * Attackers might use this to circumvent security checks:
+ * For example, a malicious user might upload a file with the name
+ * "foo.exe\0.png". This file name might pass security checks (i.e.
+ * checks for the extension ".png"), while, depending on the underlying
+ * C library, it might create a file named "foo.exe", as the NUL
+ * character is the string terminator in C.
+ */
+public class InvalidFileNameException extends RuntimeException {
+
+    /**
+     * Serial version UID, being used, if the exception
+     * is serialized.
+     */
+    private static final long serialVersionUID = 7922042602454350470L;
+
+    /**
+     * The file name causing the exception.
+     */
+    private final String name;
+
+    /**
+     * Creates a new instance.
+     *
+     * @param pName The file name causing the exception.
+     * @param pMessage A human readable error message.
+     */
+    public InvalidFileNameException(String pName, String pMessage) {
+        super(pMessage);
+        name = pName;
+    }
+
+    /**
+     * Returns the invalid file name.
+     *
+     * @return the invalid file name.
+     */
+    public String getName() {
+        return name;
+    }
+}
diff --git a/core/src/main/java/org/kohsuke/stapler/RequestImpl.java b/core/src/main/java/org/kohsuke/stapler/RequestImpl.java
index 4e38565d6..80c12c0c1 100644
--- a/core/src/main/java/org/kohsuke/stapler/RequestImpl.java
+++ b/core/src/main/java/org/kohsuke/stapler/RequestImpl.java
@@ -23,16 +23,19 @@
 
 package org.kohsuke.stapler;
 
+import com.infradna.tool.bridge_method_injector.WithBridgeMethods;
 import java.beans.Introspector;
 import java.beans.PropertyDescriptor;
 import java.io.File;
 import java.io.IOException;
+import java.io.UncheckedIOException;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Field;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
 import java.lang.reflect.Type;
+import java.nio.charset.Charset;
 import java.nio.file.Files;
 import java.text.ParseException;
 import java.text.SimpleDateFormat;
@@ -66,12 +69,15 @@
 import org.apache.commons.beanutils.ConvertUtils;
 import org.apache.commons.beanutils.Converter;
 import org.apache.commons.beanutils.PropertyUtils;
-import org.apache.commons.fileupload.FileCountLimitExceededException;
-import org.apache.commons.fileupload.FileItem;
-import org.apache.commons.fileupload.FileUploadBase;
-import org.apache.commons.fileupload.FileUploadException;
-import org.apache.commons.fileupload.disk.DiskFileItemFactory;
-import org.apache.commons.fileupload.servlet.ServletFileUpload;
+import org.apache.commons.fileupload2.core.DiskFileItem;
+import org.apache.commons.fileupload2.core.DiskFileItemFactory;
+import org.apache.commons.fileupload2.core.FileItem;
+import org.apache.commons.fileupload2.core.FileUploadByteCountLimitException;
+import org.apache.commons.fileupload2.core.FileUploadException;
+import org.apache.commons.fileupload2.core.FileUploadFileCountLimitException;
+import org.apache.commons.fileupload2.core.FileUploadSizeException;
+import org.apache.commons.fileupload2.javax.JavaxServletDiskFileUpload;
+import org.apache.commons.fileupload2.javax.JavaxServletFileUpload;
 import org.jvnet.tiger_types.Lister;
 import org.kohsuke.stapler.bind.Bound;
 import org.kohsuke.stapler.bind.BoundObjectTable;
@@ -131,7 +137,7 @@ public class RequestImpl extends HttpServletRequestWrapper implements StaplerReq
 
     /**
      * Limits the number of form fields that can be processed in one multipart/form-data request.
-     * Used to set {@link org.apache.commons.fileupload.servlet.ServletFileUpload#setFileCountMax(long)}.
+     * Used to set {@link org.apache.commons.fileupload2.javax.JavaxServletFileUpload#setFileCountMax(long)}.
      * Despite the name, this applies to all form fields, not just actual file attachments.
      * Set to {@code -1} to disable limits.
      */
@@ -139,7 +145,7 @@ public class RequestImpl extends HttpServletRequestWrapper implements StaplerReq
 
     /**
      * Limits the size (in bytes) of individual fields that can be processed in one multipart/form-data request.
-     * Used to set {@link org.apache.commons.fileupload.servlet.ServletFileUpload#setFileSizeMax(long)}.
+     * Used to set {@link org.apache.commons.fileupload2.javax.JavaxServletFileUpload#setFileSizeMax(long)}.
      * Despite the name, this applies to all form fields, not just actual file attachments.
      * Set to {@code -1} to disable limits.
      */
@@ -147,7 +153,7 @@ public class RequestImpl extends HttpServletRequestWrapper implements StaplerReq
 
     /**
      * Limits the total request size (in bytes) that can be processed in one multipart/form-data request.
-     * Used to set {@link org.apache.commons.fileupload.servlet.ServletFileUpload#setSizeMax(long)}.
+     * Used to set {@link org.apache.commons.fileupload2.javax.JavaxServletFileUpload#setSizeMax(long)}.
      * Set to {@code -1} to disable limits.
      */
     private static /* nonfinal for Jenkins script console */ long FILEUPLOAD_MAX_SIZE = Long.getLong(RequestImpl.class.getName() + ".FILEUPLOAD_MAX_SIZE", -1);
@@ -1056,7 +1062,7 @@ private void parseMultipartFormData() throws ServletException {
 
         parsedFormData = new HashMap<>();
         parsedFormDataFormFields = new HashMap<>();
-        ServletFileUpload upload;
+        JavaxServletFileUpload<DiskFileItem, DiskFileItemFactory> upload;
         File tmpDir;
         try {
             tmpDir = Files.createTempDirectory("jenkins-stapler-uploads").toFile();
@@ -1064,7 +1070,7 @@ private void parseMultipartFormData() throws ServletException {
             throw new ServletException("Error creating temporary directory", e);
         }
         tmpDir.deleteOnExit();
-        upload = new ServletFileUpload(new DiskFileItemFactory(DiskFileItemFactory.DEFAULT_SIZE_THRESHOLD, tmpDir));
+        upload = new JavaxServletDiskFileUpload(DiskFileItemFactory.builder().setFile(tmpDir).get());
         upload.setFileCountMax(FILEUPLOAD_MAX_FILES);
         upload.setFileSizeMax(FILEUPLOAD_MAX_FILE_SIZE);
         upload.setSizeMax(FILEUPLOAD_MAX_SIZE);
@@ -1075,11 +1081,11 @@ private void parseMultipartFormData() throws ServletException {
                     parsedFormDataFormFields.put(fi.getFieldName(),fi.getString());
                 }
             }
-        } catch (FileCountLimitExceededException e) {
+        } catch (FileUploadFileCountLimitException e) {
             throw new ServletException("File upload field count limit exceeded. Consider setting the Java system property " + RequestImpl.class.getName() + ".FILEUPLOAD_MAX_FILES to a value greater than " + FILEUPLOAD_MAX_FILES + ", or to -1 to disable this limit.", e);
-        } catch (FileUploadBase.FileSizeLimitExceededException e) {
+        } catch (FileUploadByteCountLimitException e) {
             throw new ServletException("File upload field size limit exceeded. Consider setting the Java system property " + RequestImpl.class.getName() + ".FILEUPLOAD_MAX_FILE_SIZE to a value greater than " + FILEUPLOAD_MAX_FILE_SIZE + ", or to -1 to disable this limit.", e);
-        } catch (FileUploadBase.SizeLimitExceededException e) {
+        } catch (FileUploadSizeException e) {
             throw new ServletException("File upload total size limit exceeded. Consider setting the Java system property " + RequestImpl.class.getName() + ".FILEUPLOAD_MAX_SIZE to a value greater than " + FILEUPLOAD_MAX_SIZE + ", or to -1 to disable this limit.", e);
         } catch (FileUploadException e) {
             throw new ServletException(e);
@@ -1116,10 +1122,12 @@ public JSONObject getSubmittedForm() throws ServletException {
                     if (item.getContentType() == null && getCharacterEncoding() != null) {
                         // JENKINS-11543: If client doesn't set charset per part, use request encoding
                         try {
-                            p = item.getString(getCharacterEncoding());
+                            p = item.getString(Charset.forName(getCharacterEncoding()));
                         } catch (java.io.UnsupportedEncodingException uee) {
                             LOGGER.log(Level.WARNING, "Request has unsupported charset, using default for 'json' parameter", uee);
                             p = item.getString();
+                        } catch (IOException e) {
+                            throw new UncheckedIOException(e);
                         }
                     } else {
                         p = item.getString();
@@ -1158,6 +1166,7 @@ private boolean isMultipart() {
     }
 
     @Override
+    @WithBridgeMethods(value = org.apache.commons.fileupload.FileItem.class, adapterMethod = "fromFileUpload2FileItem")
     public FileItem getFileItem(String name) throws ServletException, IOException {
         parseMultipartFormData();
         if(parsedFormData==null)    return null;
@@ -1166,5 +1175,9 @@ public FileItem getFileItem(String name) throws ServletException, IOException {
         return item;
     }
 
+    private Object fromFileUpload2FileItem(FileItem fileItem, Class<?> type) {
+        return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(fileItem);
+    }
+
     private static final Logger LOGGER = Logger.getLogger(RequestImpl.class.getName());
 }
diff --git a/core/src/main/java/org/kohsuke/stapler/Stapler.java b/core/src/main/java/org/kohsuke/stapler/Stapler.java
index 66c983951..a31888913 100644
--- a/core/src/main/java/org/kohsuke/stapler/Stapler.java
+++ b/core/src/main/java/org/kohsuke/stapler/Stapler.java
@@ -76,7 +76,7 @@
 import org.apache.commons.beanutils.converters.DoubleConverter;
 import org.apache.commons.beanutils.converters.FloatConverter;
 import org.apache.commons.beanutils.converters.IntegerConverter;
-import org.apache.commons.fileupload.FileItem;
+import org.apache.commons.fileupload2.core.FileItem;
 import org.apache.commons.io.IOUtils;
 import org.kohsuke.stapler.bind.BoundObjectTable;
 
@@ -1152,6 +1152,20 @@ public FileItem convert(Class type, Object value) {
             }
         }, FileItem.class);
 
+        CONVERT_UTILS.register(new Converter() {
+            @Override
+            public org.apache.commons.fileupload.FileItem convert(Class type, Object value) {
+                if (value == null) {
+                    return null;
+                }
+                try {
+                    return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(Stapler.getCurrentRequest().getFileItem(value.toString()));
+                } catch (ServletException | IOException e) {
+                    throw new ConversionException(e);
+                }
+            }
+        }, org.apache.commons.fileupload.FileItem.class);
+
         // mapping for boxed types should map null to null, instead of null to zero.
         CONVERT_UTILS.register(new IntegerConverter(null),Integer.class);
         CONVERT_UTILS.register(new FloatConverter(null),Float.class);
diff --git a/core/src/main/java/org/kohsuke/stapler/StaplerRequest.java b/core/src/main/java/org/kohsuke/stapler/StaplerRequest.java
index 8171fb103..17b8ce5fe 100644
--- a/core/src/main/java/org/kohsuke/stapler/StaplerRequest.java
+++ b/core/src/main/java/org/kohsuke/stapler/StaplerRequest.java
@@ -23,6 +23,7 @@
 
 package org.kohsuke.stapler;
 
+import com.infradna.tool.bridge_method_injector.WithBridgeMethods;
 import java.io.IOException;
 import java.lang.reflect.Type;
 import java.util.Calendar;
@@ -38,7 +39,7 @@
 import net.sf.json.JSONObject;
 import org.apache.commons.beanutils.BeanUtils;
 import org.apache.commons.beanutils.ConvertUtils;
-import org.apache.commons.fileupload.FileItem;
+import org.apache.commons.fileupload2.core.FileItem;
 import org.kohsuke.stapler.bind.BoundObjectTable;
 import org.kohsuke.stapler.json.SubmittedForm;
 import org.kohsuke.stapler.lang.Klass;
@@ -497,6 +498,7 @@ public interface StaplerRequest extends HttpServletRequest {
      *      This includes the case where the name corresponds to a simple
      *      form field (like textbox, checkbox, etc.) 
      */
+    @WithBridgeMethods(org.apache.commons.fileupload.FileItem.class)
     FileItem getFileItem(String name) throws ServletException, IOException;
 
     /**
diff --git a/core/src/test/java/org/kohsuke/stapler/RequestImplTest.java b/core/src/test/java/org/kohsuke/stapler/RequestImplTest.java
index 2751eeb9e..4d8b0468d 100644
--- a/core/src/test/java/org/kohsuke/stapler/RequestImplTest.java
+++ b/core/src/test/java/org/kohsuke/stapler/RequestImplTest.java
@@ -39,7 +39,7 @@
 import javax.servlet.ServletInputStream;
 import javax.servlet.http.HttpServletRequest;
 import net.sf.json.JSONObject;
-import org.apache.commons.fileupload.FileItem;
+import org.apache.commons.fileupload2.core.FileItem;
 import org.apache.http.entity.ContentType;
 import org.apache.http.entity.mime.MultipartEntityBuilder;
 import org.junit.Assert;