Skip to content

Commit 5a18e98

Browse files
HoneyryderChuckHoneyryderChuck
committed
probe content type of files using secure mechanism
current implementations are relying on file name/extension, which is prone to errors (.mp4, is it a video or a picture?) and spoofing. This change allows customers to use or opt into mechanisms which inspect the first bytes of a file's payload
1 parent 71b33db commit 5a18e98

File tree

11 files changed

+110
-66
lines changed
  • modules/openapi-generator/src/main/resources/Java/libraries/okhttp-gson
  • samples/client
    • echo_api/java/okhttp-gson/src/main/java/org/openapitools/client
    • others/java/okhttp-gson-streaming/src/main/java/org/openapitools/client
    • petstore/java
      • okhttp-gson/src/main/java/org/openapitools/client
      • okhttp-gson-awsv4signature/src/main/java/org/openapitools/client
      • okhttp-gson-dynamicOperations/src/main/java/org/openapitools/client
      • okhttp-gson-group-parameter/src/main/java/org/openapitools/client
      • okhttp-gson-nullable-required/src/main/java/org/openapitools/client
      • okhttp-gson-parcelableModel/src/main/java/org/openapitools/client
      • okhttp-gson-swagger1/src/main/java/org/openapitools/client
      • okhttp-gson-swagger2/src/main/java/org/openapitools/client

11 files changed

+110
-66
lines changed

‎modules/openapi-generator/src/main/resources/Java/libraries/okhttp-gson/ApiClient.mustache

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1643,21 +1643,25 @@ public class ApiClient {
16431643
* @return The guessed Content-Type
16441644
*/
16451645
public String guessContentTypeFromFile(File file) {
1646-
String contentType = URLConnection.guessContentTypeFromName(file.getName());
1647-
if (contentType == null) {
1646+
try {
1647+
String contentType = Files.probeContentType(file.toPath());
1648+
if (contentType == null) {
1649+
return "application/octet-stream";
1650+
} else {
1651+
return contentType;
1652+
}
1653+
} catch(IOException error) {
16481654
return "application/octet-stream";
1649-
} else {
1650-
return contentType;
16511655
}
16521656
}
16531657

16541658
/**
16551659
* Add a Content-Disposition Header for the given key and file to the MultipartBody Builder.
16561660
*
1657-
* @param mpBuilder MultipartBody.Builder
1661+
* @param mpBuilder MultipartBody.Builder
16581662
* @param key The key of the Header element
16591663
* @param file The file to add to the Header
1660-
*/
1664+
*/
16611665
private void addPartToMultiPartBuilder(MultipartBody.Builder mpBuilder, String key, File file) {
16621666
Headers partHeaders = Headers.of("Content-Disposition", "form-data; name=\"" + key + "\"; filename=\"" + file.getName() + "\"");
16631667
MediaType mediaType = MediaType.parse(guessContentTypeFromFile(file));

‎samples/client/echo_api/java/okhttp-gson/src/main/java/org/openapitools/client/ApiClient.java

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1383,21 +1383,25 @@ public RequestBody buildRequestBodyMultipart(Map<String, Object> formParams) {
13831383
* @return The guessed Content-Type
13841384
*/
13851385
public String guessContentTypeFromFile(File file) {
1386-
String contentType = URLConnection.guessContentTypeFromName(file.getName());
1387-
if (contentType == null) {
1386+
try {
1387+
String contentType = Files.probeContentType(file.toPath());
1388+
if (contentType == null) {
1389+
return "application/octet-stream";
1390+
} else {
1391+
return contentType;
1392+
}
1393+
} catch(IOException error) {
13881394
return "application/octet-stream";
1389-
} else {
1390-
return contentType;
13911395
}
13921396
}
13931397

13941398
/**
13951399
* Add a Content-Disposition Header for the given key and file to the MultipartBody Builder.
13961400
*
1397-
* @param mpBuilder MultipartBody.Builder
1401+
* @param mpBuilder MultipartBody.Builder
13981402
* @param key The key of the Header element
13991403
* @param file The file to add to the Header
1400-
*/
1404+
*/
14011405
private void addPartToMultiPartBuilder(MultipartBody.Builder mpBuilder, String key, File file) {
14021406
Headers partHeaders = Headers.of("Content-Disposition", "form-data; name=\"" + key + "\"; filename=\"" + file.getName() + "\"");
14031407
MediaType mediaType = MediaType.parse(guessContentTypeFromFile(file));

‎samples/client/others/java/okhttp-gson-streaming/src/main/java/org/openapitools/client/ApiClient.java

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1406,21 +1406,25 @@ public RequestBody buildRequestBodyMultipart(Map<String, Object> formParams) {
14061406
* @return The guessed Content-Type
14071407
*/
14081408
public String guessContentTypeFromFile(File file) {
1409-
String contentType = URLConnection.guessContentTypeFromName(file.getName());
1410-
if (contentType == null) {
1409+
try {
1410+
String contentType = Files.probeContentType(file.toPath());
1411+
if (contentType == null) {
1412+
return "application/octet-stream";
1413+
} else {
1414+
return contentType;
1415+
}
1416+
} catch(IOException error) {
14111417
return "application/octet-stream";
1412-
} else {
1413-
return contentType;
14141418
}
14151419
}
14161420

14171421
/**
14181422
* Add a Content-Disposition Header for the given key and file to the MultipartBody Builder.
14191423
*
1420-
* @param mpBuilder MultipartBody.Builder
1424+
* @param mpBuilder MultipartBody.Builder
14211425
* @param key The key of the Header element
14221426
* @param file The file to add to the Header
1423-
*/
1427+
*/
14241428
private void addPartToMultiPartBuilder(MultipartBody.Builder mpBuilder, String key, File file) {
14251429
Headers partHeaders = Headers.of("Content-Disposition", "form-data; name=\"" + key + "\"; filename=\"" + file.getName() + "\"");
14261430
MediaType mediaType = MediaType.parse(guessContentTypeFromFile(file));

‎samples/client/petstore/java/okhttp-gson-awsv4signature/src/main/java/org/openapitools/client/ApiClient.java

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1491,21 +1491,25 @@ public RequestBody buildRequestBodyMultipart(Map<String, Object> formParams) {
14911491
* @return The guessed Content-Type
14921492
*/
14931493
public String guessContentTypeFromFile(File file) {
1494-
String contentType = URLConnection.guessContentTypeFromName(file.getName());
1495-
if (contentType == null) {
1494+
try {
1495+
String contentType = Files.probeContentType(file.toPath());
1496+
if (contentType == null) {
1497+
return "application/octet-stream";
1498+
} else {
1499+
return contentType;
1500+
}
1501+
} catch(IOException error) {
14961502
return "application/octet-stream";
1497-
} else {
1498-
return contentType;
14991503
}
15001504
}
15011505

15021506
/**
15031507
* Add a Content-Disposition Header for the given key and file to the MultipartBody Builder.
15041508
*
1505-
* @param mpBuilder MultipartBody.Builder
1509+
* @param mpBuilder MultipartBody.Builder
15061510
* @param key The key of the Header element
15071511
* @param file The file to add to the Header
1508-
*/
1512+
*/
15091513
private void addPartToMultiPartBuilder(MultipartBody.Builder mpBuilder, String key, File file) {
15101514
Headers partHeaders = Headers.of("Content-Disposition", "form-data; name=\"" + key + "\"; filename=\"" + file.getName() + "\"");
15111515
MediaType mediaType = MediaType.parse(guessContentTypeFromFile(file));

‎samples/client/petstore/java/okhttp-gson-dynamicOperations/src/main/java/org/openapitools/client/ApiClient.java

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1484,21 +1484,25 @@ public RequestBody buildRequestBodyMultipart(Map<String, Object> formParams) {
14841484
* @return The guessed Content-Type
14851485
*/
14861486
public String guessContentTypeFromFile(File file) {
1487-
String contentType = URLConnection.guessContentTypeFromName(file.getName());
1488-
if (contentType == null) {
1487+
try {
1488+
String contentType = Files.probeContentType(file.toPath());
1489+
if (contentType == null) {
1490+
return "application/octet-stream";
1491+
} else {
1492+
return contentType;
1493+
}
1494+
} catch(IOException error) {
14891495
return "application/octet-stream";
1490-
} else {
1491-
return contentType;
14921496
}
14931497
}
14941498

14951499
/**
14961500
* Add a Content-Disposition Header for the given key and file to the MultipartBody Builder.
14971501
*
1498-
* @param mpBuilder MultipartBody.Builder
1502+
* @param mpBuilder MultipartBody.Builder
14991503
* @param key The key of the Header element
15001504
* @param file The file to add to the Header
1501-
*/
1505+
*/
15021506
private void addPartToMultiPartBuilder(MultipartBody.Builder mpBuilder, String key, File file) {
15031507
Headers partHeaders = Headers.of("Content-Disposition", "form-data; name=\"" + key + "\"; filename=\"" + file.getName() + "\"");
15041508
MediaType mediaType = MediaType.parse(guessContentTypeFromFile(file));

‎samples/client/petstore/java/okhttp-gson-group-parameter/src/main/java/org/openapitools/client/ApiClient.java

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1479,21 +1479,25 @@ public RequestBody buildRequestBodyMultipart(Map<String, Object> formParams) {
14791479
* @return The guessed Content-Type
14801480
*/
14811481
public String guessContentTypeFromFile(File file) {
1482-
String contentType = URLConnection.guessContentTypeFromName(file.getName());
1483-
if (contentType == null) {
1482+
try {
1483+
String contentType = Files.probeContentType(file.toPath());
1484+
if (contentType == null) {
1485+
return "application/octet-stream";
1486+
} else {
1487+
return contentType;
1488+
}
1489+
} catch(IOException error) {
14841490
return "application/octet-stream";
1485-
} else {
1486-
return contentType;
14871491
}
14881492
}
14891493

14901494
/**
14911495
* Add a Content-Disposition Header for the given key and file to the MultipartBody Builder.
14921496
*
1493-
* @param mpBuilder MultipartBody.Builder
1497+
* @param mpBuilder MultipartBody.Builder
14941498
* @param key The key of the Header element
14951499
* @param file The file to add to the Header
1496-
*/
1500+
*/
14971501
private void addPartToMultiPartBuilder(MultipartBody.Builder mpBuilder, String key, File file) {
14981502
Headers partHeaders = Headers.of("Content-Disposition", "form-data; name=\"" + key + "\"; filename=\"" + file.getName() + "\"");
14991503
MediaType mediaType = MediaType.parse(guessContentTypeFromFile(file));

‎samples/client/petstore/java/okhttp-gson-nullable-required/src/main/java/org/openapitools/client/ApiClient.java

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1482,21 +1482,25 @@ public RequestBody buildRequestBodyMultipart(Map<String, Object> formParams) {
14821482
* @return The guessed Content-Type
14831483
*/
14841484
public String guessContentTypeFromFile(File file) {
1485-
String contentType = URLConnection.guessContentTypeFromName(file.getName());
1486-
if (contentType == null) {
1485+
try {
1486+
String contentType = Files.probeContentType(file.toPath());
1487+
if (contentType == null) {
1488+
return "application/octet-stream";
1489+
} else {
1490+
return contentType;
1491+
}
1492+
} catch(IOException error) {
14871493
return "application/octet-stream";
1488-
} else {
1489-
return contentType;
14901494
}
14911495
}
14921496

14931497
/**
14941498
* Add a Content-Disposition Header for the given key and file to the MultipartBody Builder.
14951499
*
1496-
* @param mpBuilder MultipartBody.Builder
1500+
* @param mpBuilder MultipartBody.Builder
14971501
* @param key The key of the Header element
14981502
* @param file The file to add to the Header
1499-
*/
1503+
*/
15001504
private void addPartToMultiPartBuilder(MultipartBody.Builder mpBuilder, String key, File file) {
15011505
Headers partHeaders = Headers.of("Content-Disposition", "form-data; name=\"" + key + "\"; filename=\"" + file.getName() + "\"");
15021506
MediaType mediaType = MediaType.parse(guessContentTypeFromFile(file));

‎samples/client/petstore/java/okhttp-gson-parcelableModel/src/main/java/org/openapitools/client/ApiClient.java

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1485,21 +1485,25 @@ public RequestBody buildRequestBodyMultipart(Map<String, Object> formParams) {
14851485
* @return The guessed Content-Type
14861486
*/
14871487
public String guessContentTypeFromFile(File file) {
1488-
String contentType = URLConnection.guessContentTypeFromName(file.getName());
1489-
if (contentType == null) {
1488+
try {
1489+
String contentType = Files.probeContentType(file.toPath());
1490+
if (contentType == null) {
1491+
return "application/octet-stream";
1492+
} else {
1493+
return contentType;
1494+
}
1495+
} catch(IOException error) {
14901496
return "application/octet-stream";
1491-
} else {
1492-
return contentType;
14931497
}
14941498
}
14951499

14961500
/**
14971501
* Add a Content-Disposition Header for the given key and file to the MultipartBody Builder.
14981502
*
1499-
* @param mpBuilder MultipartBody.Builder
1503+
* @param mpBuilder MultipartBody.Builder
15001504
* @param key The key of the Header element
15011505
* @param file The file to add to the Header
1502-
*/
1506+
*/
15031507
private void addPartToMultiPartBuilder(MultipartBody.Builder mpBuilder, String key, File file) {
15041508
Headers partHeaders = Headers.of("Content-Disposition", "form-data; name=\"" + key + "\"; filename=\"" + file.getName() + "\"");
15051509
MediaType mediaType = MediaType.parse(guessContentTypeFromFile(file));

‎samples/client/petstore/java/okhttp-gson-swagger1/src/main/java/org/openapitools/client/ApiClient.java

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1479,21 +1479,25 @@ public RequestBody buildRequestBodyMultipart(Map<String, Object> formParams) {
14791479
* @return The guessed Content-Type
14801480
*/
14811481
public String guessContentTypeFromFile(File file) {
1482-
String contentType = URLConnection.guessContentTypeFromName(file.getName());
1483-
if (contentType == null) {
1482+
try {
1483+
String contentType = Files.probeContentType(file.toPath());
1484+
if (contentType == null) {
1485+
return "application/octet-stream";
1486+
} else {
1487+
return contentType;
1488+
}
1489+
} catch(IOException error) {
14841490
return "application/octet-stream";
1485-
} else {
1486-
return contentType;
14871491
}
14881492
}
14891493

14901494
/**
14911495
* Add a Content-Disposition Header for the given key and file to the MultipartBody Builder.
14921496
*
1493-
* @param mpBuilder MultipartBody.Builder
1497+
* @param mpBuilder MultipartBody.Builder
14941498
* @param key The key of the Header element
14951499
* @param file The file to add to the Header
1496-
*/
1500+
*/
14971501
private void addPartToMultiPartBuilder(MultipartBody.Builder mpBuilder, String key, File file) {
14981502
Headers partHeaders = Headers.of("Content-Disposition", "form-data; name=\"" + key + "\"; filename=\"" + file.getName() + "\"");
14991503
MediaType mediaType = MediaType.parse(guessContentTypeFromFile(file));

‎samples/client/petstore/java/okhttp-gson-swagger2/src/main/java/org/openapitools/client/ApiClient.java

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1479,21 +1479,25 @@ public RequestBody buildRequestBodyMultipart(Map<String, Object> formParams) {
14791479
* @return The guessed Content-Type
14801480
*/
14811481
public String guessContentTypeFromFile(File file) {
1482-
String contentType = URLConnection.guessContentTypeFromName(file.getName());
1483-
if (contentType == null) {
1482+
try {
1483+
String contentType = Files.probeContentType(file.toPath());
1484+
if (contentType == null) {
1485+
return "application/octet-stream";
1486+
} else {
1487+
return contentType;
1488+
}
1489+
} catch(IOException error) {
14841490
return "application/octet-stream";
1485-
} else {
1486-
return contentType;
14871491
}
14881492
}
14891493

14901494
/**
14911495
* Add a Content-Disposition Header for the given key and file to the MultipartBody Builder.
14921496
*
1493-
* @param mpBuilder MultipartBody.Builder
1497+
* @param mpBuilder MultipartBody.Builder
14941498
* @param key The key of the Header element
14951499
* @param file The file to add to the Header
1496-
*/
1500+
*/
14971501
private void addPartToMultiPartBuilder(MultipartBody.Builder mpBuilder, String key, File file) {
14981502
Headers partHeaders = Headers.of("Content-Disposition", "form-data; name=\"" + key + "\"; filename=\"" + file.getName() + "\"");
14991503
MediaType mediaType = MediaType.parse(guessContentTypeFromFile(file));

‎samples/client/petstore/java/okhttp-gson/src/main/java/org/openapitools/client/ApiClient.java

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1544,21 +1544,25 @@ public RequestBody buildRequestBodyMultipart(Map<String, Object> formParams) {
15441544
* @return The guessed Content-Type
15451545
*/
15461546
public String guessContentTypeFromFile(File file) {
1547-
String contentType = URLConnection.guessContentTypeFromName(file.getName());
1548-
if (contentType == null) {
1547+
try {
1548+
String contentType = Files.probeContentType(file.toPath());
1549+
if (contentType == null) {
1550+
return "application/octet-stream";
1551+
} else {
1552+
return contentType;
1553+
}
1554+
} catch(IOException error) {
15491555
return "application/octet-stream";
1550-
} else {
1551-
return contentType;
15521556
}
15531557
}
15541558

15551559
/**
15561560
* Add a Content-Disposition Header for the given key and file to the MultipartBody Builder.
15571561
*
1558-
* @param mpBuilder MultipartBody.Builder
1562+
* @param mpBuilder MultipartBody.Builder
15591563
* @param key The key of the Header element
15601564
* @param file The file to add to the Header
1561-
*/
1565+
*/
15621566
private void addPartToMultiPartBuilder(MultipartBody.Builder mpBuilder, String key, File file) {
15631567
Headers partHeaders = Headers.of("Content-Disposition", "form-data; name=\"" + key + "\"; filename=\"" + file.getName() + "\"");
15641568
MediaType mediaType = MediaType.parse(guessContentTypeFromFile(file));

0 commit comments

Comments
 (0)