[JENKINS-73170] Upgrade Commons FileUpload from 1.5 to 2.0.0-M2 (#9259)

core/src/main/java/hudson/FilePath.java

@@ -80,6 +80,7 @@ import java.io.OutputStream;
 import java.io.OutputStreamWriter;
 import java.io.RandomAccessFile;
 import java.io.Serializable;
+import java.io.UncheckedIOException;
 import java.io.Writer;
 import java.net.HttpURLConnection;
 import java.net.MalformedURLException;
@@ -132,7 +133,7 @@ import jenkins.util.SystemProperties;
 import jenkins.util.VirtualFile;
 import org.apache.commons.compress.archivers.tar.TarArchiveEntry;
 import org.apache.commons.compress.archivers.tar.TarArchiveInputStream;
-import org.apache.commons.fileupload.FileItem;
+import org.apache.commons.fileupload2.core.FileItem;
 import org.apache.commons.io.input.CountingInputStream;
 import org.apache.tools.ant.BuildException;
 import org.apache.tools.ant.DirectoryScanner;
@@ -1166,7 +1167,9 @@ public final class FilePath implements SerializableOnlyOverRemoting {
     public void copyFrom(FileItem file) throws IOException, InterruptedException {
         if (channel == null) {
             try {
-                file.write(new File(remote));
+                file.write(Paths.get(remote));
+            } catch (UncheckedIOException e) {
+                throw e.getCause();
             } catch (IOException e) {
                 throw e;
             } catch (Exception e) {
@@ -1180,6 +1183,14 @@ public final class FilePath implements SerializableOnlyOverRemoting {
         }
     }
 
+    /**
+     * @deprecated use {@link #copyFrom(FileItem)}
+     */
+    @Deprecated
+    public void copyFrom(org.apache.commons.fileupload.FileItem file) throws IOException, InterruptedException {
+        copyFrom(file.toFileUpload2FileItem());
+    }
+
     /**
      * Code that gets executed on the machine where the {@link FilePath} is local.
      * Used to act on {@link FilePath}.

core/src/main/java/hudson/PluginManager.java

@@ -139,10 +139,12 @@ import jenkins.util.io.OnMaster;
 import jenkins.util.xml.RestrictiveEntityResolver;
 import net.sf.json.JSONArray;
 import net.sf.json.JSONObject;
-import org.apache.commons.fileupload.FileItem;
-import org.apache.commons.fileupload.FileUploadException;
-import org.apache.commons.fileupload.disk.DiskFileItemFactory;
-import org.apache.commons.fileupload.servlet.ServletFileUpload;
+import org.apache.commons.fileupload2.core.DiskFileItem;
+import org.apache.commons.fileupload2.core.DiskFileItemFactory;
+import org.apache.commons.fileupload2.core.FileItem;
+import org.apache.commons.fileupload2.core.FileUploadException;
+import org.apache.commons.fileupload2.javax.JavaxServletDiskFileUpload;
+import org.apache.commons.fileupload2.javax.JavaxServletFileUpload;
 import org.apache.commons.io.FileUtils;
 import org.apache.commons.io.FilenameUtils;
 import org.apache.commons.io.IOUtils;
@@ -1832,13 +1834,21 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
         }
 
         @Override
-        public void copy(File target) throws Exception {
-            fileItem.write(target);
+        public void copy(File target) throws IOException {
+            try {
+                fileItem.write(Util.fileToPath(target));
+            } catch (UncheckedIOException e) {
+                throw e.getCause();
+            }
         }
 
         @Override
         public void cleanup() {
-            fileItem.delete();
+            try {
+                fileItem.delete();
+            } catch (IOException e) {
+                throw new UncheckedIOException(e);
+            }
         }
     }
 
@@ -1873,8 +1883,8 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
             String fileName = "";
             PluginCopier copier;
             File tmpDir = Files.createTempDirectory("uploadDir").toFile();
-            ServletFileUpload upload = new ServletFileUpload(new DiskFileItemFactory(DiskFileItemFactory.DEFAULT_SIZE_THRESHOLD, tmpDir));
-            List<FileItem> items = upload.parseRequest(req);
+            JavaxServletFileUpload<DiskFileItem, DiskFileItemFactory> upload = new JavaxServletDiskFileUpload(DiskFileItemFactory.builder().setFile(tmpDir).get());
+            List<DiskFileItem> items = upload.parseRequest(req);
             String string = items.get(1).getString();
             if (string != null && !string.isBlank()) {
                 // this is a URL deployment

core/src/main/java/hudson/model/FileParameterDefinition.java

@@ -35,7 +35,7 @@ import java.nio.file.Files;
 import java.util.Objects;
 import javax.servlet.ServletException;
 import net.sf.json.JSONObject;
-import org.apache.commons.fileupload.FileItem;
+import org.apache.commons.fileupload2.core.FileItem;
 import org.apache.commons.io.FileUtils;
 import org.jenkinsci.Symbol;
 import org.kohsuke.stapler.DataBoundConstructor;
@@ -90,7 +90,7 @@ public class FileParameterDefinition extends ParameterDefinition {
     public ParameterValue createValue(StaplerRequest req) {
         FileItem src;
         try {
-            src = req.getFileItem(getName());
+            src = req.getFileItem2(getName());
         } catch (ServletException | IOException e) {
             // Not sure what to do here. We might want to raise this
             // but that would involve changing the throws for this call

core/src/main/java/hudson/model/FileParameterValue.java

@@ -39,11 +39,13 @@ import java.io.UncheckedIOException;
 import java.io.UnsupportedEncodingException;
 import java.nio.charset.Charset;
 import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.regex.Pattern;
 import jenkins.util.SystemProperties;
-import org.apache.commons.fileupload.FileItem;
-import org.apache.commons.fileupload.FileItemHeaders;
-import org.apache.commons.fileupload.util.FileItemHeadersImpl;
+import org.apache.commons.fileupload2.core.FileItem;
+import org.apache.commons.fileupload2.core.FileItemFactory;
+import org.apache.commons.fileupload2.core.FileItemHeaders;
+import org.apache.commons.fileupload2.core.FileItemHeadersProvider;
 import org.apache.commons.io.FilenameUtils;
 import org.kohsuke.accmod.Restricted;
 import org.kohsuke.accmod.restrictions.NoExternalUse;
@@ -90,8 +92,16 @@ public class FileParameterValue extends ParameterValue {
         this(name, file, FilenameUtils.getName(file.getName()));
     }
 
+    /**
+     * @deprecated use {@link #FileParameterValue(String, FileItem)}
+     */
+    @Deprecated
+    public FileParameterValue(String name, org.apache.commons.fileupload.FileItem file) {
+        this(name, file.toFileUpload2FileItem(), FilenameUtils.getName(file.getName()));
+    }
+
     public FileParameterValue(String name, File file, String originalFileName) {
-        this(name, new FileItemImpl(file), originalFileName);
+        this(name, new FileItemImpl2(file), originalFileName);
     }
 
     protected FileParameterValue(String name, FileItem file, String originalFileName) {
@@ -139,10 +149,18 @@ public class FileParameterValue extends ParameterValue {
         return originalFileName;
     }
 
-    public FileItem getFile() {
+    public FileItem getFile2() {
         return file;
     }
 
+    /**
+     * @deprecated use {@link #getFile2}
+     */
+    @Deprecated
+    public org.apache.commons.fileupload.FileItem getFile() {
+        return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(getFile2());
+    }
+
     @Override
     public BuildWrapper createBuildWrapper(AbstractBuild<?, ?> build) {
         return new BuildWrapper() {
@@ -241,11 +259,120 @@ public class FileParameterValue extends ParameterValue {
 
     /**
      * Default implementation from {@link File}.
+     *
+     * @deprecated use {@link FileItemImpl2}
      */
-    public static final class FileItemImpl implements FileItem {
-        private final File file;
+    @Deprecated
+    public static final class FileItemImpl implements org.apache.commons.fileupload.FileItem {
+        private final FileItem delegate;
 
         public FileItemImpl(File file) {
+            if (file == null) {
+                throw new NullPointerException("file");
+            }
+            this.delegate = new FileItemImpl2(file);
+        }
+
+        @Override
+        public InputStream getInputStream() throws IOException {
+            return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).getInputStream();
+        }
+
+        @Override
+        public String getContentType() {
+            return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).getContentType();
+        }
+
+        @Override
+        @SuppressFBWarnings(value = "FILE_UPLOAD_FILENAME", justification = "for compatibility")
+        public String getName() {
+            return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).getName();
+        }
+
+        @Override
+        public boolean isInMemory() {
+            return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).isInMemory();
+        }
+
+        @Override
+        public long getSize() {
+            return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).getSize();
+        }
+
+        @Override
+        public byte[] get() {
+            return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).get();
+        }
+
+        @Override
+        public String getString(String encoding) throws UnsupportedEncodingException {
+            return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).getString(encoding);
+        }
+
+        @Override
+        public String getString() {
+            return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).getString();
+        }
+
+        @Override
+        public void write(File to) throws Exception {
+            org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).write(to);
+        }
+
+        @Override
+        public void delete() {
+            org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).delete();
+        }
+
+        @Override
+        public String getFieldName() {
+            return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).getFieldName();
+        }
+
+        @Override
+        public void setFieldName(String name) {
+            org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).setFieldName(name);
+        }
+
+        @Override
+        public boolean isFormField() {
+            return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).isFormField();
+        }
+
+        @Override
+        public void setFormField(boolean state) {
+            org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).setFormField(state);
+        }
+
+        @Override
+        @Deprecated
+        public OutputStream getOutputStream() throws IOException {
+            return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).getOutputStream();
+        }
+
+        @Override
+        public org.apache.commons.fileupload.FileItemHeaders getHeaders() {
+            return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).getHeaders();
+        }
+
+        @Override
+        public void setHeaders(org.apache.commons.fileupload.FileItemHeaders headers) {
+            org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(delegate).setHeaders(headers);
+        }
+
+        @Override
+        public FileItem toFileUpload2FileItem() {
+            return delegate;
+        }
+    }
+
+    /**
+     * Default implementation from {@link File}.
+     */
+    public static final class FileItemImpl2 implements FileItem {
+        private final File file;
+
+        public FileItemImpl2(File file) {
             if (file == null) {
                 throw new NullPointerException("file");
             }
@@ -287,8 +414,12 @@ public class FileParameterValue extends ParameterValue {
         }
 
         @Override
-        public String getString(String encoding) throws UnsupportedEncodingException {
-            return new String(get(), encoding);
+        public String getString(Charset toCharset) throws IOException {
+            try {
+                return new String(get(), toCharset);
+            } catch (UncheckedIOException e) {
+                throw e.getCause();
+            }
         }
 
         @Override
@@ -297,17 +428,19 @@ public class FileParameterValue extends ParameterValue {
         }
 
         @Override
-        public void write(File to) throws Exception {
-            new FilePath(file).copyTo(new FilePath(to));
+        public FileItem write(Path to) throws IOException {
+            try {
+                new FilePath(file).copyTo(new FilePath(to.toFile()));
+            } catch (InterruptedException e) {
+                throw new RuntimeException(e);
+            }
+            return this;
         }
 
         @Override
-        public void delete() {
-            try {
-                Files.deleteIfExists(file.toPath());
-            } catch (IOException e) {
-                throw new UncheckedIOException(e);
-            }
+        public FileItem delete() throws IOException {
+            Files.deleteIfExists(Util.fileToPath(file));
+            return this;
         }
 
         @Override
@@ -316,7 +449,8 @@ public class FileParameterValue extends ParameterValue {
         }
 
         @Override
-        public void setFieldName(String name) {
+        public FileItem setFieldName(String name) {
+            return this;
         }
 
         @Override
@@ -325,7 +459,8 @@ public class FileParameterValue extends ParameterValue {
         }
 
         @Override
-        public void setFormField(boolean state) {
+        public FileItem setFormField(boolean state) {
+            return this;
         }
 
         @Override
@@ -336,11 +471,12 @@ public class FileParameterValue extends ParameterValue {
 
         @Override
         public FileItemHeaders getHeaders() {
-            return new FileItemHeadersImpl();
+            return FileItemFactory.AbstractFileItemBuilder.newFileItemHeaders();
         }
 
         @Override
-        public void setHeaders(FileItemHeaders headers) {
+        public FileItemHeadersProvider setHeaders(FileItemHeaders headers) {
+            return this;
         }
     }
 }

core/src/main/java/hudson/util/MultipartFormDataParser.java

@@ -27,17 +27,21 @@ package hudson.util;
 import edu.umd.cs.findbugs.annotations.CheckForNull;
 import java.io.File;
 import java.io.IOException;
+import java.io.UncheckedIOException;
 import java.nio.file.Files;
 import java.util.HashMap;
 import java.util.Map;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
-import org.apache.commons.fileupload.FileCountLimitExceededException;
-import org.apache.commons.fileupload.FileItem;
-import org.apache.commons.fileupload.FileUploadBase;
-import org.apache.commons.fileupload.FileUploadException;
-import org.apache.commons.fileupload.disk.DiskFileItemFactory;
-import org.apache.commons.fileupload.servlet.ServletFileUpload;
+import org.apache.commons.fileupload2.core.DiskFileItem;
+import org.apache.commons.fileupload2.core.DiskFileItemFactory;
+import org.apache.commons.fileupload2.core.FileItem;
+import org.apache.commons.fileupload2.core.FileUploadByteCountLimitException;
+import org.apache.commons.fileupload2.core.FileUploadException;
+import org.apache.commons.fileupload2.core.FileUploadFileCountLimitException;
+import org.apache.commons.fileupload2.core.FileUploadSizeException;
+import org.apache.commons.fileupload2.javax.JavaxServletDiskFileUpload;
+import org.apache.commons.fileupload2.javax.JavaxServletFileUpload;
 import org.kohsuke.accmod.Restricted;
 import org.kohsuke.accmod.restrictions.NoExternalUse;
 
@@ -52,7 +56,7 @@ public class MultipartFormDataParser implements AutoCloseable {
 
     /**
      * Limits the number of form fields that can be processed in one multipart/form-data request.
-     * Used to set {@link org.apache.commons.fileupload.servlet.ServletFileUpload#setFileCountMax(long)}.
+     * Used to set {@link org.apache.commons.fileupload2.javax.JavaxServletFileUpload#setFileCountMax(long)}.
      * Despite the name, this applies to all form fields, not just actual file attachments.
      * Set to {@code -1} to disable limits.
      */
@@ -60,7 +64,7 @@ public class MultipartFormDataParser implements AutoCloseable {
 
     /**
      * Limits the size (in bytes) of individual fields that can be processed in one multipart/form-data request.
-     * Used to set {@link org.apache.commons.fileupload.servlet.ServletFileUpload#setFileSizeMax(long)}.
+     * Used to set {@link org.apache.commons.fileupload2.javax.JavaxServletFileUpload#setFileSizeMax(long)}.
      * Despite the name, this applies to all form fields, not just actual file attachments.
      * Set to {@code -1} to disable limits.
      */
@@ -68,7 +72,7 @@ public class MultipartFormDataParser implements AutoCloseable {
 
     /**
      * Limits the total request size (in bytes) that can be processed in one multipart/form-data request.
-     * Used to set {@link org.apache.commons.fileupload.servlet.ServletFileUpload#setSizeMax(long)}.
+     * Used to set {@link org.apache.commons.fileupload2.javax.JavaxServletFileUpload#setSizeMax(long)}.
      * Set to {@code -1} to disable limits.
      */
     private static /* nonfinal for Jenkins script console */ long FILEUPLOAD_MAX_SIZE = Long.getLong(MultipartFormDataParser.class.getName() + ".FILEUPLOAD_MAX_SIZE", -1);
@@ -82,20 +86,20 @@ public class MultipartFormDataParser implements AutoCloseable {
             throw new ServletException("Error creating temporary directory", e);
         }
         tmpDir.deleteOnExit();
-        ServletFileUpload upload = new ServletFileUpload(new DiskFileItemFactory(DiskFileItemFactory.DEFAULT_SIZE_THRESHOLD, tmpDir));
+        JavaxServletFileUpload<DiskFileItem, DiskFileItemFactory> upload = new JavaxServletDiskFileUpload(DiskFileItemFactory.builder().setFile(tmpDir).get());
         upload.setFileCountMax(maxParts);
         upload.setFileSizeMax(maxPartSize);
         upload.setSizeMax(maxSize);
         try {
             for (FileItem fi : upload.parseRequest(request))
                 byName.put(fi.getFieldName(), fi);
-        } catch (FileCountLimitExceededException e) {
+        } catch (FileUploadFileCountLimitException e) {
             throw new ServletException("File upload field count limit exceeded. Consider setting the Java system property "
                     + MultipartFormDataParser.class.getName() + ".FILEUPLOAD_MAX_FILES to a value greater than " + FILEUPLOAD_MAX_FILES + ", or to -1 to disable this limit.", e);
-        } catch (FileUploadBase.FileSizeLimitExceededException e) {
+        } catch (FileUploadByteCountLimitException e) {
             throw new ServletException("File upload field size limit exceeded. Consider setting the Java system property "
                     + MultipartFormDataParser.class.getName() + ".FILEUPLOAD_MAX_FILE_SIZE to a value greater than " + FILEUPLOAD_MAX_FILE_SIZE + ", or to -1 to disable this limit.", e);
-        } catch (FileUploadBase.SizeLimitExceededException e) {
+        } catch (FileUploadSizeException e) {
             throw new ServletException("File upload total size limit exceeded. Consider setting the Java system property "
                     + MultipartFormDataParser.class.getName() + ".FILEUPLOAD_MAX_SIZE to a value greater than " + FILEUPLOAD_MAX_SIZE + ", or to -1 to disable this limit.", e);
         } catch (FileUploadException e) {
@@ -118,17 +122,30 @@ public class MultipartFormDataParser implements AutoCloseable {
         return fi.getString();
     }
 
-    public FileItem getFileItem(String key) {
+    public FileItem getFileItem2(String key) {
         return byName.get(key);
     }
 
+    /**
+     * @deprecated use {@link #getFileItem2(String)}
+     */
+    @Deprecated
+    public org.apache.commons.fileupload.FileItem getFileItem(String key) {
+        return org.apache.commons.fileupload.FileItem.fromFileUpload2FileItem(getFileItem2(key));
+    }
+
     /**
      * If any file is created on the disk, delete them all.
      * Even if this method is not called, the resource will be still cleaned up later by GC.
      */
     public void cleanUp() {
-        for (FileItem item : byName.values())
-            item.delete();
+        for (FileItem item : byName.values()) {
+            try {
+                item.delete();
+            } catch (IOException e) {
+                throw new UncheckedIOException(e);
+            }
+        }
     }
 
     /** Alias for {@link #cleanUp}. */

core/src/main/java/jenkins/model/Jenkins.java

@@ -4492,7 +4492,7 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
                 rsp.sendError(HttpServletResponse.SC_FORBIDDEN, "No crumb found");
             }
             rsp.sendRedirect2(req.getContextPath() + "/fingerprint/" +
-                Util.getDigestOf(p.getFileItem("name").getInputStream()) + '/');
+                Util.getDigestOf(p.getFileItem2("name").getInputStream()) + '/');
         }
     }