Merge pull request #3823 from jamezp/back-ports-5.0

[RESTEASY-3384] Improve parsing of malformed MediaTypes in MediaTypeH…
resteasy · Oct 5, 2023 · 74c5bd7 · 74c5bd7
2 parents 936c563 + d493a85
commit 74c5bd7
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 1 deletion.
diff --git a/...easy-core/src/main/java/org/jboss/resteasy/plugins/delegates/MediaTypeHeaderDelegate.java b/...easy-core/src/main/java/org/jboss/resteasy/plugins/delegates/MediaTypeHeaderDelegate.java
@@ -93,7 +93,11 @@ private static MediaType internalParse(String type) {
         } else {
             major = type.substring(0, typeIndex);
             if (paramIndex > -1) {
-                subtype = type.substring(typeIndex + 1, paramIndex);
+                int beginIndex = typeIndex + 1;
+                if (beginIndex > paramIndex) {
+                    throw new IllegalArgumentException(Messages.MESSAGES.failureParsingMediaType(type));
+                }
+                subtype = type.substring(beginIndex, paramIndex);
             } else {
                 subtype = type.substring(typeIndex + 1);
             }

diff --git a/...-core/src/test/java/org/jboss/resteasy/plugins/delegates/MediaTypeHeaderDelegateTest.java b/...-core/src/test/java/org/jboss/resteasy/plugins/delegates/MediaTypeHeaderDelegateTest.java
@@ -0,0 +1,16 @@
+package org.jboss.resteasy.plugins.delegates;
+
+import org.junit.Test;
+
+public class MediaTypeHeaderDelegateTest {
+
+    @Test(expected = IllegalArgumentException.class)
+    public void parsingBrokenMediaTypeShouldThrowIllegalArgumentException_minimized() {
+        MediaTypeHeaderDelegate.parse("x; /x");
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void parsingBrokenMediaTypeShouldThrowIllegalArgumentException_actual() {
+        MediaTypeHeaderDelegate.parse("() { ::}; echo \"NS:\" $(/bin/sh -c \"expr 123456 - 123456\")");
+    }
+}