Skip to content

Commit 6ceab7a

Browse files
DavidKorczynskiDavidKorczynski
authored
apache-commons-fileupload: fix build (#14211)
Signed-off-by: David Korczynski <david@adalogics.com>
1 parent cb360c2 commit 6ceab7a

File tree

6 files changed

+39
-34
lines changed

6 files changed

+39
-34
lines changed

‎projects/apache-commons-fileupload/Dockerfile‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,5 @@ COPY project-parent $SRC/project-parent/
3434

3535
RUN rm -rf $SRC/project-parent/apache-commons-fileupload
3636
RUN git clone --depth 1 https://github.com/apache/commons-fileupload.git $SRC/project-parent/apache-commons-fileupload
37-
3837
COPY build.sh $SRC/
39-
WORKDIR $SRC/
38+
WORKDIR $SRC/

‎projects/apache-commons-fileupload/build.sh‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,13 @@ PROJECT_GROUP_ID=org.apache.commons
2020
PROJECT_ARTIFACT_ID=commons-fileupload2
2121
MAIN_REPOSITORY=https://github.com/apache/commons-fileupload.git
2222

23-
MAVEN_ARGS="-Dmaven.test.skip=true -Djavac.src.version=15 -Djavac.target.version=15 -Denforcer.skip=true -DskipTests"
23+
MAVEN_ARGS="-Djavac.src.version=15 -Djavac.target.version=15 -Denforcer.skip=true -DskipTests"
2424

2525
function set_project_version_in_fuzz_targets_dependency {
2626
PROJECT_VERSION=$(cd $PROJECT && $MVN org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=project.version -q -DforceStdout)
2727
# set dependency project version in fuzz-targets
28-
(cd fuzz-targets && $MVN versions:use-dep-version -Dincludes=$PROJECT_GROUP_ID:$PROJECT_ARTIFACT_ID -DdepVersion=$PROJECT_VERSION -DforceVersion=true)
28+
(cd fuzz-targets && $MVN versions:use-dep-version -Dincludes=$PROJECT_GROUP_ID:commons-fileupload2-core -DdepVersion=$PROJECT_VERSION -DforceVersion=true)
29+
(cd fuzz-targets && $MVN versions:use-dep-version -Dincludes=$PROJECT_GROUP_ID:commons-fileupload2-javax -DdepVersion=$PROJECT_VERSION -DforceVersion=true)
2930
}
3031

3132
cd project-parent

‎projects/apache-commons-fileupload/project-parent/fuzz-targets/pom.xml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,12 @@
3232

3333
<dependency>
3434
<groupId>org.apache.commons</groupId>
35-
<artifactId>commons-fileupload2</artifactId>
35+
<artifactId>commons-fileupload2-core</artifactId>
36+
<version>2.0-SNAPSHOT</version>
37+
</dependency>
38+
<dependency>
39+
<groupId>org.apache.commons</groupId>
40+
<artifactId>commons-fileupload2-javax</artifactId>
3641
<version>2.0-SNAPSHOT</version>
3742
</dependency>
3843
<dependency>

‎projects/apache-commons-fileupload/project-parent/fuzz-targets/src/test/java/com/example/FileUploadFuzzer.java‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@
1818

1919
import com.code_intelligence.jazzer.api.FuzzedDataProvider;
2020
import com.code_intelligence.jazzer.junit.FuzzTest;
21-
import org.apache.commons.fileupload2.FileItem;
22-
import org.apache.commons.fileupload2.FileUpload;
23-
import org.apache.commons.fileupload2.FileUploadException;
24-
import org.apache.commons.fileupload2.MultipartStream;
25-
import org.apache.commons.fileupload2.disk.DiskFileItemFactory;
26-
import org.apache.commons.fileupload2.servlet.ServletFileUpload;
21+
import org.apache.commons.fileupload2.core.FileItem;
22+
import org.apache.commons.fileupload2.core.AbstractFileUpload;
23+
import org.apache.commons.fileupload2.core.FileUploadException;
24+
import org.apache.commons.fileupload2.core.MultipartInput;
25+
import org.apache.commons.fileupload2.core.DiskFileItemFactory;
26+
import org.apache.commons.fileupload2.javax.JavaxServletFileUpload;
2727

2828
import java.io.File;
2929
import java.io.IOException;
@@ -34,13 +34,14 @@
3434
public class FileUploadFuzzer {
3535
@FuzzTest
3636
void myFuzzTest(FuzzedDataProvider data)
37-
throws IOException, FileUploadException, MultipartStream.MalformedStreamException {
38-
DiskFileItemFactory factory = new DiskFileItemFactory();
39-
factory.setRepository(new File("/tmp/abc"));
40-
FileUpload upload = new ServletFileUpload(factory);
37+
throws IOException, FileUploadException {
38+
DiskFileItemFactory factory = DiskFileItemFactory.builder()
39+
.setPath(new File("/tmp/abc").toPath())
40+
.get();
41+
AbstractFileUpload upload = new JavaxServletFileUpload(factory);
4142

4243
// is set to tomcats default to approach CVE-2023-24998
43-
upload.setFileCountMax(10000);
44+
upload.setMaxFileCount(10000);
4445

4546
String contentType = data.consumeAsciiString(200);
4647
String multipartData = data.consumeRemainingAsString();

‎projects/apache-commons-fileupload/project-parent/fuzz-targets/src/test/java/com/example/MockHttpServletRequest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616

1717
package com.example;
1818

19-
import org.apache.commons.fileupload2.FileUploadBase;
19+
import org.apache.commons.fileupload2.core.AbstractFileUpload;
2020

2121
import javax.servlet.RequestDispatcher;
2222
import javax.servlet.ServletInputStream;
@@ -63,7 +63,7 @@ public MockHttpServletRequest(
6363
mmRequestData = requestData;
6464
length = requestLength;
6565
mStrContentType = strContentType;
66-
mHeaders.put(FileUploadBase.CONTENT_TYPE, strContentType);
66+
mHeaders.put(AbstractFileUpload.CONTENT_TYPE, strContentType);
6767
}
6868

6969
/**

‎projects/apache-commons-fileupload/project-parent/fuzz-targets/src/test/java/com/example/Util.java‎

Lines changed: 15 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,12 @@
1616

1717
package com.example;
1818

19-
import org.apache.commons.fileupload2.FileItem;
20-
import org.apache.commons.fileupload2.FileUpload;
21-
import org.apache.commons.fileupload2.FileUploadException;
22-
import org.apache.commons.fileupload2.disk.DiskFileItemFactory;
23-
import org.apache.commons.fileupload2.portlet.PortletFileUpload;
24-
import org.apache.commons.fileupload2.servlet.ServletFileUpload;
25-
import org.apache.commons.fileupload2.servlet.ServletRequestContext;
19+
import org.apache.commons.fileupload2.core.FileItem;
20+
import org.apache.commons.fileupload2.core.AbstractFileUpload;
21+
import org.apache.commons.fileupload2.core.FileUploadException;
22+
import org.apache.commons.fileupload2.core.DiskFileItemFactory;
23+
import org.apache.commons.fileupload2.javax.JavaxServletFileUpload;
24+
import org.apache.commons.fileupload2.javax.JavaxServletRequestContext;
2625

2726
import javax.servlet.http.HttpServletRequest;
2827
import java.io.UnsupportedEncodingException;
@@ -37,29 +36,29 @@
3736
*/
3837
public class Util {
3938

40-
public static List<FileItem> parseUpload(final FileUpload upload, final byte[] bytes) throws FileUploadException {
39+
public static List<FileItem> parseUpload(final AbstractFileUpload upload, final byte[] bytes) throws FileUploadException {
4140
return parseUpload(upload, bytes, Constants.CONTENT_TYPE);
4241
}
4342

44-
public static List<FileItem> parseUpload(final FileUpload upload, final byte[] bytes, final String contentType)
43+
public static List<FileItem> parseUpload(final AbstractFileUpload upload, final byte[] bytes, final String contentType)
4544
throws FileUploadException {
4645
final HttpServletRequest request = new MockHttpServletRequest(bytes, contentType);
47-
return upload.parseRequest(new ServletRequestContext(request));
46+
return upload.parseRequest(new JavaxServletRequestContext(request));
4847
}
4948

50-
public static List<FileItem> parseUpload(final FileUpload upload, final String content)
49+
public static List<FileItem> parseUpload(final AbstractFileUpload upload, final String content)
5150
throws UnsupportedEncodingException, FileUploadException {
5251
final byte[] bytes = content.getBytes(StandardCharsets.US_ASCII);
5352
return parseUpload(upload, bytes, Constants.CONTENT_TYPE);
5453
}
5554

5655
/**
57-
* Return a list of {@link FileUpload} implementations for parameterized tests.
58-
* @return a list of {@link FileUpload} implementations
56+
* Return a list of {@link AbstractFileUpload} implementations for parameterized tests.
57+
* @return a list of {@link AbstractFileUpload} implementations
5958
*/
60-
public static List<FileUpload> fileUploadImplementations() {
59+
public static List<AbstractFileUpload> fileUploadImplementations() {
60+
DiskFileItemFactory factory = DiskFileItemFactory.builder().get();
6161
return Arrays.asList(
62-
new ServletFileUpload(new DiskFileItemFactory()),
63-
new PortletFileUpload(new DiskFileItemFactory()));
62+
new JavaxServletFileUpload(factory));
6463
}
6564
}

0 commit comments

Comments
 (0)