Pin HTTP/RTSP version + method normalization to Locale.US#16765
Merged
chrisvest merged 1 commit intoMay 8, 2026
Conversation
normanmaurer
approved these changes
May 7, 2026
chrisvest
requested changes
May 7, 2026
Member
chrisvest
left a comment
There was a problem hiding this comment.
Please address my comments, then it looks good.
`HttpVersion`, `RtspVersions` and `RtspMethods` all uppercase their
input via `String.toUpperCase()` without an explicit Locale. The JVM
default Locale governs that call, and in Turkish (`tr_TR`) the
ASCII letter `'i'` uppercases to `'İ'` (U+0130), not `'I'`.
Concretely, on a Turkish-locale JVM:
- `RtspMethods.valueOf("describe")` produces `"DESCRİBE"` after the
uppercase, fails the cache lookup, falls through to
`HttpMethod.valueOf(...)` and throws
`IllegalArgumentException: Illegal character in HTTP Method: 0x130`
for what is otherwise a perfectly valid RTSP method.
- `HttpVersion.valueOf("icap/1.0")` (and the
`(protocolName, major, minor, ...)` constructor with `"icap"`) end
up with a protocolName containing U+0130 instead of ASCII `'I'`.
The protocol grammars are ASCII-only (RFC 7230 / 2326), so the
uppercase has no business consulting the JVM locale. Pin every
`toUpperCase()` in these three classes to `Locale.US`.
Tests:
- `HttpVersionParsingTest.testLowercaseIotaProtocolNameUnderTurkishLocale`
and `.testProtocolNameConstructorUnderTurkishLocale` install the
Turkish locale via `Locale.setDefault(...)` (restored in `finally`)
and assert the protocolName / text round-trip back to ASCII.
- New `RtspMethodsTest` covers cached-uppercase resolution, the
ordinary lowercase normalization path, and the Turkish-locale
variant.
All three Turkish-locale tests fail deterministically without the
`Locale.US` change and pass after it.
7bed8ef to
64c47e0
Compare
daguimu
added a commit
to daguimu/netty
that referenced
this pull request
May 8, 2026
…o Locale.US Two spots in the multipart codec call `String.toLowerCase()` without an explicit Locale to normalize a header value before comparing it to lowercase ASCII constants. The JVM default locale governs that call, and in Turkish (`tr_TR`) the ASCII letter `'I'` lowercases to `'ı'` (U+0131) - so a perfectly valid uppercase form misses the comparison. Concretely on a Turkish-locale JVM: - `HttpPostMultipartRequestDecoder` decoding a part with `Content-Transfer-Encoding: BINARY` (uppercase, RFC 2045 says the mechanism token is case-insensitive) lowercases it to `"bınary"`, fails the equality check against the `binary` / `7bit` / `8bit` constants, and throws `ErrorDataDecoderException: TransferEncoding Unknown: bınary`. - `HttpPostRequestEncoder.finalizeRequest()` skipping a pre-existing `Content-Type: MULTIPART/form-data` header (mixed case, allowed by the Content-Type ABNF) lowercases it to `"multıpart/..."`, misses the prefix check, and the original mixed-case header stays on the request alongside the freshly-built multipart Content-Type. The request goes out with two `Content-Type` headers. Pin both `toLowerCase()` calls to `Locale.US`. The values being compared against are lowercase ASCII tokens and have no business consulting the JVM locale. Tests: - `HttpPostMultiPartRequestDecoderTest .testUppercaseBinaryTransferEncodingUnderTurkishLocale` installs the Turkish locale via `Locale.setDefault(...)` (restored in `finally`) and feeds a multipart body with `Content-Transfer-Encoding: BINARY`. Without the fix it throws; after the fix the file part decodes successfully. - `HttpPostRequestEncoderTest .testFinalizeRemovesPreexistingMultipartContentTypeUnderTurkishLocale` pre-sets `Content-Type: MULTIPART/form-data; boundary=preexisting` on the request, runs the encoder under the Turkish locale, and asserts only one Content-Type header survives - the encoder's own. Without the fix the request ends up with two Content-Type headers. Both tests fail deterministically on the unfixed code (one as an assertion, the other as `TransferEncoding Unknown: bınary`). Sibling fix to netty#16765, which addressed the same locale gotcha in `HttpVersion`, `RtspMethods`, and `RtspVersions`.
chrisvest
approved these changes
May 8, 2026
Contributor
|
Could not create auto-port PR. |
Contributor
|
Auto-port PR for 5.0: #16769 |
Member
|
PR for 4.1 #16770 |
normanmaurer
added a commit
that referenced
this pull request
May 8, 2026
…16770) `HttpVersion`, `RtspVersions` and `RtspMethods` all uppercase their input via `String.toUpperCase()` without an explicit `Locale`. The JVM default locale governs that call, and in Turkish (`tr_TR`) the ASCII letter `'i'` uppercases to `'İ'` (U+0130), not `'I'`. Concretely, on a Turkish-locale JVM: - `RtspMethods.valueOf("describe")` produces `"DESCRİBE"` after the uppercase, fails the cache lookup, falls through to `HttpMethod.valueOf(...)`, and throws `IllegalArgumentException: Illegal character in HTTP Method: 0x130` for what is otherwise a perfectly valid RTSP method. Same for `"redirect"` (`REDİRECT`). - `HttpVersion.valueOf("icap/1.0")` and the `(protocolName, major, minor, ...)` constructor with `"icap"` end up with `protocolName()` containing U+0130 instead of plain ASCII `'I'`. The version no longer matches its own canonical form. The protocol grammars are ASCII-only (RFC 7230 §2.6 / RFC 2326 §1.4), so the uppercase has no business consulting the JVM locale. Pin every `String.toUpperCase()` in these three classes to `Locale.US`: - `codec-http/src/main/java/io/netty/handler/codec/http/HttpVersion.java` - `(text, strict, keepAliveDefault)` constructor — line that normalizes the supplied protocol string. - `(protocolName, major, minor, keepAliveDefault, bytes)` constructor — line that normalizes the supplied protocol name. - `codec-http/src/main/java/io/netty/handler/codec/rtsp/RtspMethods.java` - `valueOf(String name)` — line that normalizes the supplied RTSP method name before the cache lookup. - `codec-http/src/main/java/io/netty/handler/codec/rtsp/RtspVersions.java` - `valueOf(String text)` — line that normalizes the supplied version string before comparing to the cached `RTSP/1.0`. `AsciiString.toUpperCase()` / `AsciiString.toLowerCase()` paths in the same module are already ASCII-byte-level and not affected by this issue, so they are left alone. `codec-http/src/test/java/io/netty/handler/codec/http/HttpVersionParsingTest.java`: | Change Point | Test | |--------------|------| | `HttpVersion.valueOf(text)` under Turkish locale | `testLowercaseIotaProtocolNameUnderTurkishLocale` — installs `Locale.setDefault(new Locale("tr","TR"))` (restored in `finally`) and asserts `valueOf("icap/1.0")` returns a version whose `protocolName()` is the ASCII `"ICAP"` and whose `text()` is `"ICAP/1.0"`. | | `HttpVersion(protocolName, major, minor, ...)` under Turkish locale | `testProtocolNameConstructorUnderTurkishLocale` — same locale setup, asserts `new HttpVersion("icap", 1, 0, true)` ends up with `protocolName()` = `"ICAP"` and `text()` = `"ICAP/1.0"`. | New `codec-http/src/test/java/io/netty/handler/codec/rtsp/RtspMethodsTest.java`: | Change Point | Test | |--------------|------| | Cached uppercase lookup still works | `valueOfReturnsCachedInstanceForUppercaseName` | | Lowercase normalization under default locale | `valueOfNormalizesLowercaseInputUnderUsLocale` | | Lowercase normalization under Turkish locale | `valueOfNormalizesLowercaseInputUnderTurkishLocale` — installs `tr_TR`, calls `valueOf("describe")` and `valueOf("redirect")`, asserts both resolve to the cached `DESCRIBE` / `REDIRECT` instances. | All three Turkish-locale tests fail deterministically against the unfixed code (one with a clean assertion failure, the `RtspMethods` one with `IllegalArgumentException: Illegal character in HTTP Method: 0x130`) and pass after the `Locale.US` change. Verification: ``` mvn -pl codec-http -am test -Dtest='HttpVersionParsingTest,RtspMethodsTest' -Dsurefire.failIfNoSpecifiedTests=false ``` - Behavior on en/CJK/most locales: unchanged (the previous default-locale uppercase already produced ASCII). - Behavior on Turkish (and other locales with non-ASCII case mappings, e.g. Azerbaijani): RTSP method parsing and HTTP-derived version parsing of lowercase or mixed-case inputs now succeed instead of throwing or returning a U+0130-tainted result. - API: no signature change. All callers continue to use `valueOf(String)` / the existing constructors. - Risk: bounded — `Locale.US` is the standard Netty pattern for protocol-string normalization (see e.g. `WebSocketClientHandshaker.java:761`). Co-authored-by: Guimu <[email protected]>
chrisvest
added a commit
that referenced
this pull request
May 10, 2026
….US (#16769) Auto-port of #16765 to 5.0 Cherry-picked commit: e6d7cf7 --- ## Problem `HttpVersion`, `RtspVersions` and `RtspMethods` all uppercase their input via `String.toUpperCase()` without an explicit `Locale`. The JVM default locale governs that call, and in Turkish (`tr_TR`) the ASCII letter `'i'` uppercases to `'İ'` (U+0130), not `'I'`. Concretely, on a Turkish-locale JVM: - `RtspMethods.valueOf("describe")` produces `"DESCRİBE"` after the uppercase, fails the cache lookup, falls through to `HttpMethod.valueOf(...)`, and throws `IllegalArgumentException: Illegal character in HTTP Method: 0x130` for what is otherwise a perfectly valid RTSP method. Same for `"redirect"` (`REDİRECT`). - `HttpVersion.valueOf("icap/1.0")` and the `(protocolName, major, minor, ...)` constructor with `"icap"` end up with `protocolName()` containing U+0130 instead of plain ASCII `'I'`. The version no longer matches its own canonical form. The protocol grammars are ASCII-only (RFC 7230 §2.6 / RFC 2326 §1.4), so the uppercase has no business consulting the JVM locale. ## Fix Pin every `String.toUpperCase()` in these three classes to `Locale.US`: - `codec-http/src/main/java/io/netty/handler/codec/http/HttpVersion.java` - `(text, strict, keepAliveDefault)` constructor — line that normalizes the supplied protocol string. - `(protocolName, major, minor, keepAliveDefault, bytes)` constructor — line that normalizes the supplied protocol name. - `codec-http/src/main/java/io/netty/handler/codec/rtsp/RtspMethods.java` - `valueOf(String name)` — line that normalizes the supplied RTSP method name before the cache lookup. - `codec-http/src/main/java/io/netty/handler/codec/rtsp/RtspVersions.java` - `valueOf(String text)` — line that normalizes the supplied version string before comparing to the cached `RTSP/1.0`. `AsciiString.toUpperCase()` / `AsciiString.toLowerCase()` paths in the same module are already ASCII-byte-level and not affected by this issue, so they are left alone. ## Tests `codec-http/src/test/java/io/netty/handler/codec/http/HttpVersionParsingTest.java`: | Change Point | Test | |--------------|------| | `HttpVersion.valueOf(text)` under Turkish locale | `testLowercaseIotaProtocolNameUnderTurkishLocale` — installs `Locale.setDefault(new Locale("tr","TR"))` (restored in `finally`) and asserts `valueOf("icap/1.0")` returns a version whose `protocolName()` is the ASCII `"ICAP"` and whose `text()` is `"ICAP/1.0"`. | | `HttpVersion(protocolName, major, minor, ...)` under Turkish locale | `testProtocolNameConstructorUnderTurkishLocale` — same locale setup, asserts `new HttpVersion("icap", 1, 0, true)` ends up with `protocolName()` = `"ICAP"` and `text()` = `"ICAP/1.0"`. | New `codec-http/src/test/java/io/netty/handler/codec/rtsp/RtspMethodsTest.java`: | Change Point | Test | |--------------|------| | Cached uppercase lookup still works | `valueOfReturnsCachedInstanceForUppercaseName` | | Lowercase normalization under default locale | `valueOfNormalizesLowercaseInputUnderUsLocale` | | Lowercase normalization under Turkish locale | `valueOfNormalizesLowercaseInputUnderTurkishLocale` — installs `tr_TR`, calls `valueOf("describe")` and `valueOf("redirect")`, asserts both resolve to the cached `DESCRIBE` / `REDIRECT` instances. | All three Turkish-locale tests fail deterministically against the unfixed code (one with a clean assertion failure, the `RtspMethods` one with `IllegalArgumentException: Illegal character in HTTP Method: 0x130`) and pass after the `Locale.US` change. Verification: ``` mvn -pl codec-http -am test -Dtest='HttpVersionParsingTest,RtspMethodsTest' -Dsurefire.failIfNoSpecifiedTests=false # Tests run: 52, Failures: 0, Errors: 0, Skipped: 0 ``` ## Impact - Behavior on en/CJK/most locales: unchanged (the previous default-locale uppercase already produced ASCII). - Behavior on Turkish (and other locales with non-ASCII case mappings, e.g. Azerbaijani): RTSP method parsing and HTTP-derived version parsing of lowercase or mixed-case inputs now succeed instead of throwing or returning a U+0130-tainted result. - API: no signature change. All callers continue to use `valueOf(String)` / the existing constructors. - Risk: bounded — `Locale.US` is the standard Netty pattern for protocol-string normalization (see e.g. `WebSocketClientHandshaker.java:761`). Co-authored-by: Guimu <[email protected]> Co-authored-by: Chris Vest <[email protected]>
normanmaurer
added a commit
that referenced
this pull request
May 10, 2026
…o Locale.US (#16768) ## Problem Two spots in the HTTP multipart codec normalize a header value with `String.toLowerCase()` without an explicit Locale, then compare the result to lowercase ASCII constants. The JVM default Locale governs that call, and on a Turkish (`tr_TR`) JVM the ASCII `'I'` lowercases to `'ı'` (U+0131). A perfectly valid uppercase form silently misses the comparison. Concretely on a Turkish-locale JVM: - `HttpPostMultipartRequestDecoder` decoding a part with `Content-Transfer-Encoding: BINARY` (uppercase, RFC 2045 §6.1 says mechanism tokens are case-insensitive) lowercases the value to `"bınary"`, fails the equality check against the `binary` / `7bit` / `8bit` constants, and throws `ErrorDataDecoderException: TransferEncoding Unknown: bınary`. - `HttpPostRequestEncoder.finalizeRequest()` skipping a pre-existing `Content-Type: MULTIPART/form-data; boundary=...` header (mixed case is allowed by the Content-Type ABNF, RFC 7231 §3.1.1.1) lowercases the value to `"multıpart/..."`, misses the `startsWith("multipart/form-data")` check, and the original mixed-case header survives alongside the freshly-built multipart Content-Type the encoder is about to add. The outgoing request ends up with **two** `Content-Type` headers. The values being compared against are lowercase ASCII tokens and have no business consulting the JVM locale. ## Fix Pin both `String.toLowerCase()` calls to `Locale.US`: - `codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostMultipartRequestDecoder.java` — `getFileUpload(String delimiter)` lowercases the `Content-Transfer-Encoding` value before matching it against `BIT7` / `BIT8` / `BINARY` mechanism tokens. - `codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostRequestEncoder.java` — `finalizeRequest()` lowercases each existing `Content-Type` before checking if it is the multipart or `application/x-www-form-urlencoded` form (which the encoder is responsible for setting fresh). ## Tests | Change Point | Test | |--------------|------| | Decoder Content-Transfer-Encoding lowercase under Turkish | `HttpPostMultiPartRequestDecoderTest.testUppercaseBinaryTransferEncodingUnderTurkishLocale` — installs the Turkish locale (restored in `finally`), feeds a multipart body with `Content-Transfer-Encoding: BINARY`, and asserts the file part decodes successfully. Without the fix this throws `TransferEncoding Unknown: bınary`. | | Encoder Content-Type lowercase under Turkish | `HttpPostRequestEncoderTest.testFinalizeRemovesPreexistingMultipartContentTypeUnderTurkishLocale` — pre-sets `Content-Type: MULTIPART/form-data; boundary=preexisting`, runs the encoder under the Turkish locale, and asserts only one Content-Type header survives. Without the fix the request ends up with two Content-Type headers. | Both tests fail deterministically on the unfixed code (one as an assertion failure, the other as a thrown `ErrorDataDecoderException`) and pass after the `Locale.US` change. Verification: ``` mvn -pl codec-http -am test \ -Dtest='HttpPostRequestEncoderTest#testFinalizeRemovesPreexistingMultipartContentTypeUnderTurkishLocale,HttpPostMultiPartRequestDecoderTest#testUppercaseBinaryTransferEncodingUnderTurkishLocale' \ -Dsurefire.failIfNoSpecifiedTests=false # Tests run: 2, Failures: 0, Errors: 0, Skipped: 0 ``` ## Impact - Behavior on en/CJK/most locales: unchanged (the previous default-locale lowercase already produced ASCII). - Behavior on Turkish (and other locales with non-ASCII case mappings): a multipart upload with uppercase `Content-Transfer-Encoding: BINARY` now decodes instead of throwing; an outgoing multipart request with a pre-existing mixed-case `Content-Type: MULTIPART/...` no longer leaks a duplicate Content-Type header. - API: no signature change. All callers continue through the existing public API. - Risk: bounded — `Locale.US` is the standard Netty pattern for protocol-string normalization (see e.g. `WebSocketClientHandshaker.java:761`). Sibling fix to #16765, which pinned the same locale gotcha in `HttpVersion`, `RtspMethods`, and `RtspVersions`. --------- Co-authored-by: Norman Maurer <[email protected]>
normanmaurer
added a commit
that referenced
this pull request
May 11, 2026
#16784) …o Locale.US (#16768) Two spots in the HTTP multipart codec normalize a header value with `String.toLowerCase()` without an explicit Locale, then compare the result to lowercase ASCII constants. The JVM default Locale governs that call, and on a Turkish (`tr_TR`) JVM the ASCII `'I'` lowercases to `'ı'` (U+0131). A perfectly valid uppercase form silently misses the comparison. Concretely on a Turkish-locale JVM: - `HttpPostMultipartRequestDecoder` decoding a part with `Content-Transfer-Encoding: BINARY` (uppercase, RFC 2045 §6.1 says mechanism tokens are case-insensitive) lowercases the value to `"bınary"`, fails the equality check against the `binary` / `7bit` / `8bit` constants, and throws `ErrorDataDecoderException: TransferEncoding Unknown: bınary`. - `HttpPostRequestEncoder.finalizeRequest()` skipping a pre-existing `Content-Type: MULTIPART/form-data; boundary=...` header (mixed case is allowed by the Content-Type ABNF, RFC 7231 §3.1.1.1) lowercases the value to `"multıpart/..."`, misses the `startsWith("multipart/form-data")` check, and the original mixed-case header survives alongside the freshly-built multipart Content-Type the encoder is about to add. The outgoing request ends up with **two** `Content-Type` headers. The values being compared against are lowercase ASCII tokens and have no business consulting the JVM locale. Pin both `String.toLowerCase()` calls to `Locale.US`: - `codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostMultipartRequestDecoder.java` — `getFileUpload(String delimiter)` lowercases the `Content-Transfer-Encoding` value before matching it against `BIT7` / `BIT8` / `BINARY` mechanism tokens. - `codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostRequestEncoder.java` — `finalizeRequest()` lowercases each existing `Content-Type` before checking if it is the multipart or `application/x-www-form-urlencoded` form (which the encoder is responsible for setting fresh). | Change Point | Test | |--------------|------| | Decoder Content-Transfer-Encoding lowercase under Turkish | `HttpPostMultiPartRequestDecoderTest.testUppercaseBinaryTransferEncodingUnderTurkishLocale` — installs the Turkish locale (restored in `finally`), feeds a multipart body with `Content-Transfer-Encoding: BINARY`, and asserts the file part decodes successfully. Without the fix this throws `TransferEncoding Unknown: bınary`. | | Encoder Content-Type lowercase under Turkish | `HttpPostRequestEncoderTest.testFinalizeRemovesPreexistingMultipartContentTypeUnderTurkishLocale` — pre-sets `Content-Type: MULTIPART/form-data; boundary=preexisting`, runs the encoder under the Turkish locale, and asserts only one Content-Type header survives. Without the fix the request ends up with two Content-Type headers. | Both tests fail deterministically on the unfixed code (one as an assertion failure, the other as a thrown `ErrorDataDecoderException`) and pass after the `Locale.US` change. Verification: ``` mvn -pl codec-http -am test \ -Dtest='HttpPostRequestEncoderTest#testFinalizeRemovesPreexistingMultipartContentTypeUnderTurkishLocale,HttpPostMultiPartRequestDecoderTest#testUppercaseBinaryTransferEncodingUnderTurkishLocale' \ -Dsurefire.failIfNoSpecifiedTests=false ``` - Behavior on en/CJK/most locales: unchanged (the previous default-locale lowercase already produced ASCII). - Behavior on Turkish (and other locales with non-ASCII case mappings): a multipart upload with uppercase `Content-Transfer-Encoding: BINARY` now decodes instead of throwing; an outgoing multipart request with a pre-existing mixed-case `Content-Type: MULTIPART/...` no longer leaks a duplicate Content-Type header. - API: no signature change. All callers continue through the existing public API. - Risk: bounded — `Locale.US` is the standard Netty pattern for protocol-string normalization (see e.g. `WebSocketClientHandshaker.java:761`). Sibling fix to #16765, which pinned the same locale gotcha in `HttpVersion`, `RtspMethods`, and `RtspVersions`. Co-authored-by: Guimu <[email protected]>
normanmaurer
added a commit
that referenced
this pull request
May 11, 2026
… case folding to Locale.US (#16782) Auto-port of #16768 to 5.0 Cherry-picked commit: b9eacea --- ## Problem Two spots in the HTTP multipart codec normalize a header value with `String.toLowerCase()` without an explicit Locale, then compare the result to lowercase ASCII constants. The JVM default Locale governs that call, and on a Turkish (`tr_TR`) JVM the ASCII `'I'` lowercases to `'ı'` (U+0131). A perfectly valid uppercase form silently misses the comparison. Concretely on a Turkish-locale JVM: - `HttpPostMultipartRequestDecoder` decoding a part with `Content-Transfer-Encoding: BINARY` (uppercase, RFC 2045 §6.1 says mechanism tokens are case-insensitive) lowercases the value to `"bınary"`, fails the equality check against the `binary` / `7bit` / `8bit` constants, and throws `ErrorDataDecoderException: TransferEncoding Unknown: bınary`. - `HttpPostRequestEncoder.finalizeRequest()` skipping a pre-existing `Content-Type: MULTIPART/form-data; boundary=...` header (mixed case is allowed by the Content-Type ABNF, RFC 7231 §3.1.1.1) lowercases the value to `"multıpart/..."`, misses the `startsWith("multipart/form-data")` check, and the original mixed-case header survives alongside the freshly-built multipart Content-Type the encoder is about to add. The outgoing request ends up with **two** `Content-Type` headers. The values being compared against are lowercase ASCII tokens and have no business consulting the JVM locale. ## Fix Pin both `String.toLowerCase()` calls to `Locale.US`: - `codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostMultipartRequestDecoder.java` — `getFileUpload(String delimiter)` lowercases the `Content-Transfer-Encoding` value before matching it against `BIT7` / `BIT8` / `BINARY` mechanism tokens. - `codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostRequestEncoder.java` — `finalizeRequest()` lowercases each existing `Content-Type` before checking if it is the multipart or `application/x-www-form-urlencoded` form (which the encoder is responsible for setting fresh). ## Tests | Change Point | Test | |--------------|------| | Decoder Content-Transfer-Encoding lowercase under Turkish | `HttpPostMultiPartRequestDecoderTest.testUppercaseBinaryTransferEncodingUnderTurkishLocale` — installs the Turkish locale (restored in `finally`), feeds a multipart body with `Content-Transfer-Encoding: BINARY`, and asserts the file part decodes successfully. Without the fix this throws `TransferEncoding Unknown: bınary`. | | Encoder Content-Type lowercase under Turkish | `HttpPostRequestEncoderTest.testFinalizeRemovesPreexistingMultipartContentTypeUnderTurkishLocale` — pre-sets `Content-Type: MULTIPART/form-data; boundary=preexisting`, runs the encoder under the Turkish locale, and asserts only one Content-Type header survives. Without the fix the request ends up with two Content-Type headers. | Both tests fail deterministically on the unfixed code (one as an assertion failure, the other as a thrown `ErrorDataDecoderException`) and pass after the `Locale.US` change. Verification: ``` mvn -pl codec-http -am test \ -Dtest='HttpPostRequestEncoderTest#testFinalizeRemovesPreexistingMultipartContentTypeUnderTurkishLocale,HttpPostMultiPartRequestDecoderTest#testUppercaseBinaryTransferEncodingUnderTurkishLocale' \ -Dsurefire.failIfNoSpecifiedTests=false # Tests run: 2, Failures: 0, Errors: 0, Skipped: 0 ``` ## Impact - Behavior on en/CJK/most locales: unchanged (the previous default-locale lowercase already produced ASCII). - Behavior on Turkish (and other locales with non-ASCII case mappings): a multipart upload with uppercase `Content-Transfer-Encoding: BINARY` now decodes instead of throwing; an outgoing multipart request with a pre-existing mixed-case `Content-Type: MULTIPART/...` no longer leaks a duplicate Content-Type header. - API: no signature change. All callers continue through the existing public API. - Risk: bounded — `Locale.US` is the standard Netty pattern for protocol-string normalization (see e.g. `WebSocketClientHandshaker.java:761`). Sibling fix to #16765, which pinned the same locale gotcha in `HttpVersion`, `RtspMethods`, and `RtspVersions`. Co-authored-by: Guimu <[email protected]> Co-authored-by: Norman Maurer <[email protected]>
mergify Bot
added a commit
to ArcadeData/arcadedb
that referenced
this pull request
May 24, 2026
…ip ci] Bumps `netty.version` from 4.2.13.Final to 4.2.14.Final. Updates `io.netty:netty-transport` from 4.2.13.Final to 4.2.14.Final Release notes *Sourced from [io.netty:netty-transport's releases](https://github.com/netty/netty/releases).* > netty-4.2.14.Final > ------------------ > > What's Changed > -------------- > > * HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16748](https://redirect.github.com/netty/netty/pull/16748) > * HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16747](https://redirect.github.com/netty/netty/pull/16747) > * Marshalling: Explicit document security requirements by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16752](https://redirect.github.com/netty/netty/pull/16752) > * Fix io\_uring op completion TRACE logging by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16755](https://redirect.github.com/netty/netty/pull/16755) > * Quic: Ensure writes are done before notify close promise of QuicheQui… by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16758](https://redirect.github.com/netty/netty/pull/16758) > * Avoid re-parsing openssl key material with non-cached provider by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16759](https://redirect.github.com/netty/netty/pull/16759) > * Pin HTTP/RTSP version + method normalization to Locale.US by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16765](https://redirect.github.com/netty/netty/pull/16765) > * Fill MsgHdrMemoryArray#hdrs with null entry on release by [`@tsegismont`](https://github.com/tsegismont) in [netty/netty#16764](https://redirect.github.com/netty/netty/pull/16764) > * Revapi: Use default "oldVersion" by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16774](https://redirect.github.com/netty/netty/pull/16774) > * Adaptive: Fix concurrency issue in adaptive allocator by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16767](https://redirect.github.com/netty/netty/pull/16767) > * Auto-port 4.2: Make bulk byte moving in ByteBuf faster by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16781](https://redirect.github.com/netty/netty/pull/16781) > * Pin multipart Content-Type / Content-Transfer-Encoding case folding to Locale.US by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16768](https://redirect.github.com/netty/netty/pull/16768) > * Remove dead native declarations by [`@pandareen`](https://github.com/pandareen) in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783) > * Isolate tests that modify available Security providers by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16793](https://redirect.github.com/netty/netty/pull/16793) > * Remove test annotations from a method that isn't a test by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16792](https://redirect.github.com/netty/netty/pull/16792) > * Enable OpenSslCachingKeyMaterialProvider to evict stale entries after cert rotation by [`@zhangweikop`](https://github.com/zhangweikop) in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523) > * IoUring: extend user data from short to long by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16682](https://redirect.github.com/netty/netty/pull/16682) > * Revert CompositeByteBuf component search fast path by [`@yawkat`](https://github.com/yawkat) in [netty/netty#16811](https://redirect.github.com/netty/netty/pull/16811) > * HTTP2: Use 100 as default max concurrent streams setting by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16804](https://redirect.github.com/netty/netty/pull/16804) > * Fix ResumptionController wrapping by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16815](https://redirect.github.com/netty/netty/pull/16815) > * Resolve all localhost addresses without querying DNS servers by [`@JulianVennen`](https://github.com/JulianVennen) in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749) > * IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules are configured but remote peer is using ipv4 by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16803](https://redirect.github.com/netty/netty/pull/16803) > * Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16788](https://redirect.github.com/netty/netty/pull/16788) > * Route synchronous onLookupComplete exceptions via fireExceptionCaught by [`@kwondh5217`](https://github.com/kwondh5217) in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794) > * IoUring: Stop generic FileRegion drain loop when transferred() reaches count() by [`@LuciferYang`](https://github.com/LuciferYang) in [netty/netty#16826](https://redirect.github.com/netty/netty/pull/16826) > * MQTT: Allow MQTT 5 CONNECT with password only by [`@shblue21`](https://github.com/shblue21) in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833) > * Fix MQTT decoder size check after variable header replay by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16787](https://redirect.github.com/netty/netty/pull/16787) > > New Contributors > ---------------- > > * [`@pandareen`](https://github.com/pandareen) made their first contribution in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783) > * [`@zhangweikop`](https://github.com/zhangweikop) made their first contribution in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523) > * [`@JulianVennen`](https://github.com/JulianVennen) made their first contribution in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749) > * [`@kwondh5217`](https://github.com/kwondh5217) made their first contribution in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794) > * [`@shblue21`](https://github.com/shblue21) made their first contribution in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833) > > **Full Changelog**: <netty/netty@netty-4.2.13.Final...netty-4.2.14.Final> Commits * [`0a60b75`](netty/netty@0a60b75) [maven-release-plugin] prepare release netty-4.2.14.Final * [`72df658`](netty/netty@72df658) Fix MQTT decoder size check after variable header replay ([#16787](https://redirect.github.com/netty/netty/issues/16787)) * [`7125dba`](netty/netty@7125dba) MQTT: Allow MQTT 5 CONNECT with password only ([#16833](https://redirect.github.com/netty/netty/issues/16833)) * [`9e19320`](netty/netty@9e19320) IoUring: Stop generic FileRegion drain loop when transferred() reaches count(... * [`4ce9f17`](netty/netty@4ce9f17) Route synchronous onLookupComplete exceptions via fireExceptionCaught ([#16794](https://redirect.github.com/netty/netty/issues/16794)) * [`f7b1b7d`](netty/netty@f7b1b7d) Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe... * [`0ccb265`](netty/netty@0ccb265) IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules ... * [`a6aeb6d`](netty/netty@a6aeb6d) Resolve all localhost addresses without querying DNS servers ([#16749](https://redirect.github.com/netty/netty/issues/16749)) * [`c328ba2`](netty/netty@c328ba2) Fix ResumptionController wrapping ([#16815](https://redirect.github.com/netty/netty/issues/16815)) * [`bc5862b`](netty/netty@bc5862b) HTTP2: Use 100 as default max concurrent streams setting ([#16804](https://redirect.github.com/netty/netty/issues/16804)) * Additional commits viewable in [compare view](netty/netty@netty-4.2.13.Final...netty-4.2.14.Final) Updates `io.netty:netty-codec` from 4.2.13.Final to 4.2.14.Final Release notes *Sourced from [io.netty:netty-codec's releases](https://github.com/netty/netty/releases).* > netty-4.2.14.Final > ------------------ > > What's Changed > -------------- > > * HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16748](https://redirect.github.com/netty/netty/pull/16748) > * HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16747](https://redirect.github.com/netty/netty/pull/16747) > * Marshalling: Explicit document security requirements by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16752](https://redirect.github.com/netty/netty/pull/16752) > * Fix io\_uring op completion TRACE logging by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16755](https://redirect.github.com/netty/netty/pull/16755) > * Quic: Ensure writes are done before notify close promise of QuicheQui… by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16758](https://redirect.github.com/netty/netty/pull/16758) > * Avoid re-parsing openssl key material with non-cached provider by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16759](https://redirect.github.com/netty/netty/pull/16759) > * Pin HTTP/RTSP version + method normalization to Locale.US by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16765](https://redirect.github.com/netty/netty/pull/16765) > * Fill MsgHdrMemoryArray#hdrs with null entry on release by [`@tsegismont`](https://github.com/tsegismont) in [netty/netty#16764](https://redirect.github.com/netty/netty/pull/16764) > * Revapi: Use default "oldVersion" by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16774](https://redirect.github.com/netty/netty/pull/16774) > * Adaptive: Fix concurrency issue in adaptive allocator by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16767](https://redirect.github.com/netty/netty/pull/16767) > * Auto-port 4.2: Make bulk byte moving in ByteBuf faster by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16781](https://redirect.github.com/netty/netty/pull/16781) > * Pin multipart Content-Type / Content-Transfer-Encoding case folding to Locale.US by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16768](https://redirect.github.com/netty/netty/pull/16768) > * Remove dead native declarations by [`@pandareen`](https://github.com/pandareen) in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783) > * Isolate tests that modify available Security providers by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16793](https://redirect.github.com/netty/netty/pull/16793) > * Remove test annotations from a method that isn't a test by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16792](https://redirect.github.com/netty/netty/pull/16792) > * Enable OpenSslCachingKeyMaterialProvider to evict stale entries after cert rotation by [`@zhangweikop`](https://github.com/zhangweikop) in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523) > * IoUring: extend user data from short to long by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16682](https://redirect.github.com/netty/netty/pull/16682) > * Revert CompositeByteBuf component search fast path by [`@yawkat`](https://github.com/yawkat) in [netty/netty#16811](https://redirect.github.com/netty/netty/pull/16811) > * HTTP2: Use 100 as default max concurrent streams setting by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16804](https://redirect.github.com/netty/netty/pull/16804) > * Fix ResumptionController wrapping by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16815](https://redirect.github.com/netty/netty/pull/16815) > * Resolve all localhost addresses without querying DNS servers by [`@JulianVennen`](https://github.com/JulianVennen) in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749) > * IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules are configured but remote peer is using ipv4 by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16803](https://redirect.github.com/netty/netty/pull/16803) > * Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16788](https://redirect.github.com/netty/netty/pull/16788) > * Route synchronous onLookupComplete exceptions via fireExceptionCaught by [`@kwondh5217`](https://github.com/kwondh5217) in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794) > * IoUring: Stop generic FileRegion drain loop when transferred() reaches count() by [`@LuciferYang`](https://github.com/LuciferYang) in [netty/netty#16826](https://redirect.github.com/netty/netty/pull/16826) > * MQTT: Allow MQTT 5 CONNECT with password only by [`@shblue21`](https://github.com/shblue21) in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833) > * Fix MQTT decoder size check after variable header replay by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16787](https://redirect.github.com/netty/netty/pull/16787) > > New Contributors > ---------------- > > * [`@pandareen`](https://github.com/pandareen) made their first contribution in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783) > * [`@zhangweikop`](https://github.com/zhangweikop) made their first contribution in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523) > * [`@JulianVennen`](https://github.com/JulianVennen) made their first contribution in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749) > * [`@kwondh5217`](https://github.com/kwondh5217) made their first contribution in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794) > * [`@shblue21`](https://github.com/shblue21) made their first contribution in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833) > > **Full Changelog**: <netty/netty@netty-4.2.13.Final...netty-4.2.14.Final> Commits * [`0a60b75`](netty/netty@0a60b75) [maven-release-plugin] prepare release netty-4.2.14.Final * [`72df658`](netty/netty@72df658) Fix MQTT decoder size check after variable header replay ([#16787](https://redirect.github.com/netty/netty/issues/16787)) * [`7125dba`](netty/netty@7125dba) MQTT: Allow MQTT 5 CONNECT with password only ([#16833](https://redirect.github.com/netty/netty/issues/16833)) * [`9e19320`](netty/netty@9e19320) IoUring: Stop generic FileRegion drain loop when transferred() reaches count(... * [`4ce9f17`](netty/netty@4ce9f17) Route synchronous onLookupComplete exceptions via fireExceptionCaught ([#16794](https://redirect.github.com/netty/netty/issues/16794)) * [`f7b1b7d`](netty/netty@f7b1b7d) Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe... * [`0ccb265`](netty/netty@0ccb265) IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules ... * [`a6aeb6d`](netty/netty@a6aeb6d) Resolve all localhost addresses without querying DNS servers ([#16749](https://redirect.github.com/netty/netty/issues/16749)) * [`c328ba2`](netty/netty@c328ba2) Fix ResumptionController wrapping ([#16815](https://redirect.github.com/netty/netty/issues/16815)) * [`bc5862b`](netty/netty@bc5862b) HTTP2: Use 100 as default max concurrent streams setting ([#16804](https://redirect.github.com/netty/netty/issues/16804)) * Additional commits viewable in [compare view](netty/netty@netty-4.2.13.Final...netty-4.2.14.Final) Updates `io.netty:netty-handler` from 4.2.13.Final to 4.2.14.Final Release notes *Sourced from [io.netty:netty-handler's releases](https://github.com/netty/netty/releases).* > netty-4.2.14.Final > ------------------ > > What's Changed > -------------- > > * HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16748](https://redirect.github.com/netty/netty/pull/16748) > * HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16747](https://redirect.github.com/netty/netty/pull/16747) > * Marshalling: Explicit document security requirements by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16752](https://redirect.github.com/netty/netty/pull/16752) > * Fix io\_uring op completion TRACE logging by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16755](https://redirect.github.com/netty/netty/pull/16755) > * Quic: Ensure writes are done before notify close promise of QuicheQui… by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16758](https://redirect.github.com/netty/netty/pull/16758) > * Avoid re-parsing openssl key material with non-cached provider by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16759](https://redirect.github.com/netty/netty/pull/16759) > * Pin HTTP/RTSP version + method normalization to Locale.US by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16765](https://redirect.github.com/netty/netty/pull/16765) > * Fill MsgHdrMemoryArray#hdrs with null entry on release by [`@tsegismont`](https://github.com/tsegismont) in [netty/netty#16764](https://redirect.github.com/netty/netty/pull/16764) > * Revapi: Use default "oldVersion" by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16774](https://redirect.github.com/netty/netty/pull/16774) > * Adaptive: Fix concurrency issue in adaptive allocator by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16767](https://redirect.github.com/netty/netty/pull/16767) > * Auto-port 4.2: Make bulk byte moving in ByteBuf faster by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16781](https://redirect.github.com/netty/netty/pull/16781) > * Pin multipart Content-Type / Content-Transfer-Encoding case folding to Locale.US by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16768](https://redirect.github.com/netty/netty/pull/16768) > * Remove dead native declarations by [`@pandareen`](https://github.com/pandareen) in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783) > * Isolate tests that modify available Security providers by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16793](https://redirect.github.com/netty/netty/pull/16793) > * Remove test annotations from a method that isn't a test by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16792](https://redirect.github.com/netty/netty/pull/16792) > * Enable OpenSslCachingKeyMaterialProvider to evict stale entries after cert rotation by [`@zhangweikop`](https://github.com/zhangweikop) in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523) > * IoUring: extend user data from short to long by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16682](https://redirect.github.com/netty/netty/pull/16682) > * Revert CompositeByteBuf component search fast path by [`@yawkat`](https://github.com/yawkat) in [netty/netty#16811](https://redirect.github.com/netty/netty/pull/16811) > * HTTP2: Use 100 as default max concurrent streams setting by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16804](https://redirect.github.com/netty/netty/pull/16804) > * Fix ResumptionController wrapping by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16815](https://redirect.github.com/netty/netty/pull/16815) > * Resolve all localhost addresses without querying DNS servers by [`@JulianVennen`](https://github.com/JulianVennen) in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749) > * IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules are configured but remote peer is using ipv4 by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16803](https://redirect.github.com/netty/netty/pull/16803) > * Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16788](https://redirect.github.com/netty/netty/pull/16788) > * Route synchronous onLookupComplete exceptions via fireExceptionCaught by [`@kwondh5217`](https://github.com/kwondh5217) in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794) > * IoUring: Stop generic FileRegion drain loop when transferred() reaches count() by [`@LuciferYang`](https://github.com/LuciferYang) in [netty/netty#16826](https://redirect.github.com/netty/netty/pull/16826) > * MQTT: Allow MQTT 5 CONNECT with password only by [`@shblue21`](https://github.com/shblue21) in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833) > * Fix MQTT decoder size check after variable header replay by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16787](https://redirect.github.com/netty/netty/pull/16787) > > New Contributors > ---------------- > > * [`@pandareen`](https://github.com/pandareen) made their first contribution in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783) > * [`@zhangweikop`](https://github.com/zhangweikop) made their first contribution in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523) > * [`@JulianVennen`](https://github.com/JulianVennen) made their first contribution in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749) > * [`@kwondh5217`](https://github.com/kwondh5217) made their first contribution in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794) > * [`@shblue21`](https://github.com/shblue21) made their first contribution in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833) > > **Full Changelog**: <netty/netty@netty-4.2.13.Final...netty-4.2.14.Final> Commits * [`0a60b75`](netty/netty@0a60b75) [maven-release-plugin] prepare release netty-4.2.14.Final * [`72df658`](netty/netty@72df658) Fix MQTT decoder size check after variable header replay ([#16787](https://redirect.github.com/netty/netty/issues/16787)) * [`7125dba`](netty/netty@7125dba) MQTT: Allow MQTT 5 CONNECT with password only ([#16833](https://redirect.github.com/netty/netty/issues/16833)) * [`9e19320`](netty/netty@9e19320) IoUring: Stop generic FileRegion drain loop when transferred() reaches count(... * [`4ce9f17`](netty/netty@4ce9f17) Route synchronous onLookupComplete exceptions via fireExceptionCaught ([#16794](https://redirect.github.com/netty/netty/issues/16794)) * [`f7b1b7d`](netty/netty@f7b1b7d) Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe... * [`0ccb265`](netty/netty@0ccb265) IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules ... * [`a6aeb6d`](netty/netty@a6aeb6d) Resolve all localhost addresses without querying DNS servers ([#16749](https://redirect.github.com/netty/netty/issues/16749)) * [`c328ba2`](netty/netty@c328ba2) Fix ResumptionController wrapping ([#16815](https://redirect.github.com/netty/netty/issues/16815)) * [`bc5862b`](netty/netty@bc5862b) HTTP2: Use 100 as default max concurrent streams setting ([#16804](https://redirect.github.com/netty/netty/issues/16804)) * Additional commits viewable in [compare view](netty/netty@netty-4.2.13.Final...netty-4.2.14.Final) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
mergify Bot
added a commit
to ArcadeData/arcadedb
that referenced
this pull request
May 24, 2026
…l [skip ci] Bumps [io.netty:netty-all](https://github.com/netty/netty) from 4.2.13.Final to 4.2.14.Final. Release notes *Sourced from [io.netty:netty-all's releases](https://github.com/netty/netty/releases).* > netty-4.2.14.Final > ------------------ > > What's Changed > -------------- > > * HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16748](https://redirect.github.com/netty/netty/pull/16748) > * HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16747](https://redirect.github.com/netty/netty/pull/16747) > * Marshalling: Explicit document security requirements by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16752](https://redirect.github.com/netty/netty/pull/16752) > * Fix io\_uring op completion TRACE logging by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16755](https://redirect.github.com/netty/netty/pull/16755) > * Quic: Ensure writes are done before notify close promise of QuicheQui… by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16758](https://redirect.github.com/netty/netty/pull/16758) > * Avoid re-parsing openssl key material with non-cached provider by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16759](https://redirect.github.com/netty/netty/pull/16759) > * Pin HTTP/RTSP version + method normalization to Locale.US by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16765](https://redirect.github.com/netty/netty/pull/16765) > * Fill MsgHdrMemoryArray#hdrs with null entry on release by [`@tsegismont`](https://github.com/tsegismont) in [netty/netty#16764](https://redirect.github.com/netty/netty/pull/16764) > * Revapi: Use default "oldVersion" by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16774](https://redirect.github.com/netty/netty/pull/16774) > * Adaptive: Fix concurrency issue in adaptive allocator by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16767](https://redirect.github.com/netty/netty/pull/16767) > * Auto-port 4.2: Make bulk byte moving in ByteBuf faster by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16781](https://redirect.github.com/netty/netty/pull/16781) > * Pin multipart Content-Type / Content-Transfer-Encoding case folding to Locale.US by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16768](https://redirect.github.com/netty/netty/pull/16768) > * Remove dead native declarations by [`@pandareen`](https://github.com/pandareen) in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783) > * Isolate tests that modify available Security providers by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16793](https://redirect.github.com/netty/netty/pull/16793) > * Remove test annotations from a method that isn't a test by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16792](https://redirect.github.com/netty/netty/pull/16792) > * Enable OpenSslCachingKeyMaterialProvider to evict stale entries after cert rotation by [`@zhangweikop`](https://github.com/zhangweikop) in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523) > * IoUring: extend user data from short to long by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16682](https://redirect.github.com/netty/netty/pull/16682) > * Revert CompositeByteBuf component search fast path by [`@yawkat`](https://github.com/yawkat) in [netty/netty#16811](https://redirect.github.com/netty/netty/pull/16811) > * HTTP2: Use 100 as default max concurrent streams setting by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16804](https://redirect.github.com/netty/netty/pull/16804) > * Fix ResumptionController wrapping by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16815](https://redirect.github.com/netty/netty/pull/16815) > * Resolve all localhost addresses without querying DNS servers by [`@JulianVennen`](https://github.com/JulianVennen) in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749) > * IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules are configured but remote peer is using ipv4 by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16803](https://redirect.github.com/netty/netty/pull/16803) > * Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16788](https://redirect.github.com/netty/netty/pull/16788) > * Route synchronous onLookupComplete exceptions via fireExceptionCaught by [`@kwondh5217`](https://github.com/kwondh5217) in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794) > * IoUring: Stop generic FileRegion drain loop when transferred() reaches count() by [`@LuciferYang`](https://github.com/LuciferYang) in [netty/netty#16826](https://redirect.github.com/netty/netty/pull/16826) > * MQTT: Allow MQTT 5 CONNECT with password only by [`@shblue21`](https://github.com/shblue21) in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833) > * Fix MQTT decoder size check after variable header replay by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16787](https://redirect.github.com/netty/netty/pull/16787) > > New Contributors > ---------------- > > * [`@pandareen`](https://github.com/pandareen) made their first contribution in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783) > * [`@zhangweikop`](https://github.com/zhangweikop) made their first contribution in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523) > * [`@JulianVennen`](https://github.com/JulianVennen) made their first contribution in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749) > * [`@kwondh5217`](https://github.com/kwondh5217) made their first contribution in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794) > * [`@shblue21`](https://github.com/shblue21) made their first contribution in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833) > > **Full Changelog**: <netty/netty@netty-4.2.13.Final...netty-4.2.14.Final> Commits * [`0a60b75`](netty/netty@0a60b75) [maven-release-plugin] prepare release netty-4.2.14.Final * [`72df658`](netty/netty@72df658) Fix MQTT decoder size check after variable header replay ([#16787](https://redirect.github.com/netty/netty/issues/16787)) * [`7125dba`](netty/netty@7125dba) MQTT: Allow MQTT 5 CONNECT with password only ([#16833](https://redirect.github.com/netty/netty/issues/16833)) * [`9e19320`](netty/netty@9e19320) IoUring: Stop generic FileRegion drain loop when transferred() reaches count(... * [`4ce9f17`](netty/netty@4ce9f17) Route synchronous onLookupComplete exceptions via fireExceptionCaught ([#16794](https://redirect.github.com/netty/netty/issues/16794)) * [`f7b1b7d`](netty/netty@f7b1b7d) Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe... * [`0ccb265`](netty/netty@0ccb265) IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules ... * [`a6aeb6d`](netty/netty@a6aeb6d) Resolve all localhost addresses without querying DNS servers ([#16749](https://redirect.github.com/netty/netty/issues/16749)) * [`c328ba2`](netty/netty@c328ba2) Fix ResumptionController wrapping ([#16815](https://redirect.github.com/netty/netty/issues/16815)) * [`bc5862b`](netty/netty@bc5862b) HTTP2: Use 100 as default max concurrent streams setting ([#16804](https://redirect.github.com/netty/netty/issues/16804)) * Additional commits viewable in [compare view](netty/netty@netty-4.2.13.Final...netty-4.2.14.Final) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
HttpVersion,RtspVersionsandRtspMethodsall uppercase their input viaString.toUpperCase()without an explicitLocale. The JVM default locale governs that call, and in Turkish (tr_TR) the ASCII letter'i'uppercases to'İ'(U+0130), not'I'.Concretely, on a Turkish-locale JVM:
RtspMethods.valueOf("describe")produces"DESCRİBE"after the uppercase, fails the cache lookup, falls through toHttpMethod.valueOf(...), and throwsIllegalArgumentException: Illegal character in HTTP Method: 0x130for what is otherwise a perfectly valid RTSP method. Same for"redirect"(REDİRECT).HttpVersion.valueOf("icap/1.0")and the(protocolName, major, minor, ...)constructor with"icap"end up withprotocolName()containing U+0130 instead of plain ASCII'I'. The version no longer matches its own canonical form.The protocol grammars are ASCII-only (RFC 7230 §2.6 / RFC 2326 §1.4), so the uppercase has no business consulting the JVM locale.
Fix
Pin every
String.toUpperCase()in these three classes toLocale.US:codec-http/src/main/java/io/netty/handler/codec/http/HttpVersion.java(text, strict, keepAliveDefault)constructor — line that normalizes the supplied protocol string.(protocolName, major, minor, keepAliveDefault, bytes)constructor — line that normalizes the supplied protocol name.codec-http/src/main/java/io/netty/handler/codec/rtsp/RtspMethods.javavalueOf(String name)— line that normalizes the supplied RTSP method name before the cache lookup.codec-http/src/main/java/io/netty/handler/codec/rtsp/RtspVersions.javavalueOf(String text)— line that normalizes the supplied version string before comparing to the cachedRTSP/1.0.AsciiString.toUpperCase()/AsciiString.toLowerCase()paths in the same module are already ASCII-byte-level and not affected by this issue, so they are left alone.Tests
codec-http/src/test/java/io/netty/handler/codec/http/HttpVersionParsingTest.java:HttpVersion.valueOf(text)under Turkish localetestLowercaseIotaProtocolNameUnderTurkishLocale— installsLocale.setDefault(new Locale("tr","TR"))(restored infinally) and assertsvalueOf("icap/1.0")returns a version whoseprotocolName()is the ASCII"ICAP"and whosetext()is"ICAP/1.0".HttpVersion(protocolName, major, minor, ...)under Turkish localetestProtocolNameConstructorUnderTurkishLocale— same locale setup, assertsnew HttpVersion("icap", 1, 0, true)ends up withprotocolName()="ICAP"andtext()="ICAP/1.0".New
codec-http/src/test/java/io/netty/handler/codec/rtsp/RtspMethodsTest.java:valueOfReturnsCachedInstanceForUppercaseNamevalueOfNormalizesLowercaseInputUnderUsLocalevalueOfNormalizesLowercaseInputUnderTurkishLocale— installstr_TR, callsvalueOf("describe")andvalueOf("redirect"), asserts both resolve to the cachedDESCRIBE/REDIRECTinstances.All three Turkish-locale tests fail deterministically against the unfixed code (one with a clean assertion failure, the
RtspMethodsone withIllegalArgumentException: Illegal character in HTTP Method: 0x130) and pass after theLocale.USchange.Verification:
Impact
valueOf(String)/ the existing constructors.Locale.USis the standard Netty pattern for protocol-string normalization (see e.g.WebSocketClientHandshaker.java:761).