Skip to content

Commit cd3d69d

Browse files
benweissmannok2c
authored andcommitted
Adjust comments
1 parent 5087f63 commit cd3d69d

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

httpclient5/src/main/java/org/apache/hc/client5/http/entity/mime/MultipartEntityBuilder.java

+8-2
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,12 @@
5050
* This class constructs multipart entities with a boundary determined by either a random UUID
5151
* or an explicit boundary set via {@link #setBoundary(String)}.
5252
* </p>
53+
* <p>
54+
* IMPORTANT: it is responsibility of the caller to validate / sanitize content of body
55+
* parts. For instance, when using an explicit boundary, it's the caller's responsibility to
56+
* ensure the body parts do not contain the boundary value, which can prevent the consumer of
57+
* the entity from correctly parsing / processing the body parts.
58+
* </p>
5359
*
5460
* @since 5.0
5561
*/
@@ -228,8 +234,8 @@ public MultipartEntityBuilder addBinaryBody(final String name, final InputStream
228234
* Generates a random boundary using UUID. The UUID is a v4 random UUID generated from a cryptographically-secure
229235
* random source.
230236
* <p>
231-
* A cryptographically-secure random number source is used to avoid security issues similar to
232-
* CVE-2025-22150 (affecting the Node.JS ecosystem).
237+
* A cryptographically-secure random number source is used to generate the UUID, to avoid a malicious actor crafting
238+
* a body part that contains the boundary value to tamper with the entity structure.
233239
* </p>
234240
*/
235241
private String getRandomBoundary() {

0 commit comments

Comments
 (0)