Illegal hex characters in escape (%) pattern

深碍√TFBOYSˉ_ 2023-06-13 09:19 3阅读 0赞

> URLDecoder: Illegal hex characters in escape (%) pattern - For input string: "TR"

**场景：**

> 上传附件，对文件名称URL解码时，当文件名称包含特殊字符（‘+’、‘%’）会抛出异常：llegal hex characters in escape。

**程序：**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3E1NDI0NDEyNQ_size_16_color_FFFFFF_t_70][]

**错误日志：**

--> URL：http://xxxxxxxx.xxx/uploadBigFile
     --> userInfo：{userId =xxx1, realName=xxxxx, companyId=null, orgName=xxx, companyName=null, orgId=xx, username=xxxx}
     --> requestParams：{uploadType=default, busiName=attachment, userId=xxx, currentUserName=64093, xxx=xxx, xxx=xxx, xx=undefined, chunkMD5=xxx, size=5160288, lastModifiedDate=Wed Nov 13 2019 14:29:40 GMT+0800 (中国标准时间), name=%TR%H1gfaR~85)_]0ZAV{6g.jpg, id=WU_FILE_1, fileMD5=xxxxx, type=image/jpeg, }
     ------------------------------------------------------------------------------------------------------------------------------------------------
    java.lang.IllegalArgumentException: URLDecoder: Illegal hex characters in escape (%) pattern - For input string: "TR"
    	at java.net.URLDecoder.decode(URLDecoder.java:194) ~[?:1.8.0_121]
    	at xxx.xxxx.xxxx.xxx.getUploadFile(xxx.java:764) ~[classes/:2.12.0-SNAPSHOT]
    	at xxxx.xxxx.xxx.xxx.xxx.xxx.uploadBigFile(xxxx.java:225) ~[classes/:2.12.0-SNAPSHOT]
    	at sun.reflect.GeneratedMethodAccessor149.invoke(Unknown Source) ~[?:?]
    	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_121]
    	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_121]
    	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:221) ~[spring-web-4.2.5.RELEASE.jar:4.2.5.RELEASE]
    	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:136) ~[spring-web-4.2.5.RELEASE.jar:4.2.5.RELEASE]
    	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:110) ~[spring-webmvc-4.2.5.RELEASE.jar:4.2.5.RELEASE]
    ....

通过查看日志，发现用户上传的名称：%TR%H1gfaR~85)\_\]0ZAV\{6g.jpg

有没有发现什么？没错，文件名称中带有特殊字符%.

找到了问题就好办了，我们首先来看下URLDecoder.decode源码

**URLDecoder.decode****源码：**

public static String decode(String s, String enc)
        throws UnsupportedEncodingException{
    
        boolean needToChange = false;
        int numChars = s.length();
        StringBuffer sb = new StringBuffer(numChars > 500 ? numChars / 2 : numChars);
        int i = 0;
    
        if (enc.length() == 0) {
            throw new UnsupportedEncodingException ("URLDecoder: empty string enc parameter");
        }
    
        char c;
        byte[] bytes = null;
        // 对%，+做了特殊处理
        while (i < numChars) {
            c = s.charAt(i);
            switch (c) {
            case '+':
                sb.append(' ');
                i++;
                needToChange = true;
                break;
            case '%':
                /*
                 * Starting with this instance of %, process all
                 * consecutive substrings of the form %xy. Each
                 * substring %xy will yield a byte. Convert all
                 * consecutive  bytes obtained this way to whatever
                 * character(s) they represent in the provided
                 * encoding.
                 */
    
                try {
    
                    // (numChars-i)/3 is an upper bound for the number
                    // of remaining bytes
                    if (bytes == null)
                        bytes = new byte[(numChars-i)/3];
                    int pos = 0;
    
                    while ( ((i+2) < numChars) &&
                            (c=='%')) {
                        int v = Integer.parseInt(s.substring(i+1,i+3),16);
                        if (v < 0)
                            throw new IllegalArgumentException("URLDecoder: Illegal hex characters in escape (%) pattern - negative value");
                        bytes[pos++] = (byte) v;
                        i+= 3;
                        if (i < numChars)
                            c = s.charAt(i);
                    }
    
                    // A trailing, incomplete byte encoding such as
                    // "%x" will cause an exception to be thrown
    
                    if ((i < numChars) && (c=='%'))
                        throw new IllegalArgumentException(
                         "URLDecoder: Incomplete trailing escape (%) pattern");
    
                    sb.append(new String(bytes, 0, pos, enc));
                } catch (NumberFormatException e) {
                    throw new IllegalArgumentException(
                    "URLDecoder: Illegal hex characters in escape (%) pattern - "
                    + e.getMessage());
                }
                needToChange = true;
                break;
            default:
                sb.append(c);
                i++;
                break;
            }
        }
    
        return (needToChange? sb.toString() : s);
    }

> 通过看上面URLDecode 解码源码可以看出：
> 
> 对%紧跟的后两位做了处理，所以我们需要将%后两位做下处理，保证%的格式是%25。

> 说明：%经过url编码后的值是 %25

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3E1NDI0NDEyNQ_size_16_color_FFFFFF_t_70 1][]

**修改后的代码：**

> 解决方法在这：name = name.replaceAll("%(?!\[0-9a-fA-F\]\{2\})", "%25");

UploadFile uploadFile = new UploadFile();
    String id = request.getParameter("id");
    String name = request.getParameter("name");
    if(StringUtil.isNotBlank(name)){
       try {
          // 将%后两位补充25
          name = name.replaceAll("%(?![0-9a-fA-F]{2})", "%25");
          name=URLDecoder.decode(name, "utf-8");
       } catch (UnsupportedEncodingException e) {
          log.warn("上传文件的名称（name）URL解码异常!",e);
       }
    }
    if (!name.contains(".")) {
       name = name+".jpg";
    }

OK，问题解决！

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3E1NDI0NDEyNQ_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20191115111824390.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3E1NDI0NDEyNQ==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3E1NDI0NDEyNQ_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20191115111822602.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3E1NDI0NDEyNQ==,size_16,color_FFFFFF,t_70