apache · reta · Apr 10, 2026 · Apr 3, 2026
diff --git a/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java b/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java
@@ -556,7 +556,7 @@ public static Attachment createMtomAttachmentFromDH(
             if (f.exists() && f.isFile()) {
                 file = f.getName();
             }
-            att.setHeader("Content-Disposition", "attachment;name=\"" + file + "\"");
+            att.setHeader("Content-Disposition", "attachment; name=\"" + file + "\"");
         }
         att.setXOP(isXop);
         return att;

diff --git a/rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/provider/EntityPartProvider.java b/rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/provider/EntityPartProvider.java
@@ -183,7 +183,7 @@ protected void checkContentLength() {
     }
 
     private static <T> List<Attachment> convertToDataHandlers(final List<EntityPart> parts, final  Class<T> type,
-            final Type genericType, final Annotation[] anns)  throws IOException {
+            final Type genericType, final Annotation[] anns) {
         final List<Attachment> attachments = new ArrayList<>(parts.size());
         for (EntityPart part: parts) {
             attachments.add(createDataHandler(part, type, genericType, anns));
@@ -192,7 +192,7 @@ private static <T> List<Attachment> convertToDataHandlers(final List<EntityPart>
     }
 
     private static <T> Attachment createDataHandler(final EntityPart part, final Class<T> type,
-            final Type genericType, final Annotation[] anns) throws IOException {
+            final Type genericType, final Annotation[] anns) {
 
         final String mt = Objects
             .requireNonNullElse(part.getMediaType(), MediaType.APPLICATION_OCTET_STREAM_TYPE)
@@ -205,7 +205,8 @@ private static <T> Attachment createDataHandler(final EntityPart part, final Cla
 
         return part.getFileName()
             .map(fileName -> {
-                final ContentDisposition cd = new ContentDisposition("form-data;name=file;filename=" + fileName);
+                final ContentDisposition cd = new ContentDisposition(
+                        "form-data; name=\"file\"; filename=\"" + fileName + "\"");
                 return new Attachment(part.getName(), part.getContent(), cd);
             })
             .orElseGet(() -> {

diff --git a/rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/provider/MultipartProvider.java b/rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/provider/MultipartProvider.java
@@ -346,7 +346,7 @@ private <T> Attachment createDataHandler(T obj,
         } else if (File.class.isAssignableFrom(obj.getClass())) {
             File f = (File)obj;
             ContentDisposition cd = mainMediaType.startsWith(MediaType.MULTIPART_FORM_DATA)
-                ? new ContentDisposition("form-data;name=file;filename=" + f.getName()) :  null;
+                ? new ContentDisposition("form-data; name=\"file\"; filename=\"" + f.getName() + "\"") :  null;
             return new Attachment(AttachmentUtil.BODY_ATTACHMENT_ID, Files.newInputStream(f.toPath()), cd);
         } else if (Attachment.class.isAssignableFrom(obj.getClass())) {
             Attachment att = (Attachment)obj;
@@ -357,14 +357,14 @@ private <T> Attachment createDataHandler(T obj,
                                      att.getObject().getClass(), new Annotation[]{},
                                      att.getContentType().toString(), id);
             MediaType mediaType = httpHeaders.getMediaType();
-            Attachment ret = null;
+            Attachment ret;
             if (MediaType.MULTIPART_FORM_DATA_TYPE.isCompatible(mediaType)
                 && att.getHeader("Content-Disposition") == null) {
                 ContentDisposition cd = new 
-                    ContentDisposition("form-data;name=\"" 
+                    ContentDisposition("form-data; name=\""
                         + att.getContentId() + "\"");
-                MultivaluedMap<String, String> newHeaders = 
-                    new MetadataMap<String, String>(att.getHeaders(), false, true);
+                MultivaluedMap<String, String> newHeaders =
+                        new MetadataMap<>(att.getHeaders(), false, true);
                 newHeaders.putSingle("Content-Disposition", cd.toString());
                 ret = new Attachment(att.getContentId(), dh, newHeaders);
             } else {
@@ -450,12 +450,12 @@ private String getRootMediaType(Annotation[] anns, MediaType mt) {
     }
 
     private static class MessageBodyWriterDataHandler<T> extends DataHandler {
-        private MessageBodyWriter<T> writer;
-        private T obj;
-        private Class<T> cls;
-        private Type genericType;
-        private Annotation[] anns;
-        private MediaType contentType;
+        private final MessageBodyWriter<T> writer;
+        private final T obj;
+        private final Class<T> cls;
+        private final Type genericType;
+        private final Annotation[] anns;
+        private final MediaType contentType;
         MessageBodyWriterDataHandler(MessageBodyWriter<T> writer,
                                      T obj,
                                      Class<T> cls,
@@ -475,7 +475,7 @@ private static class MessageBodyWriterDataHandler<T> extends DataHandler {
         public void writeTo(OutputStream os) {
             try {
                 writer.writeTo(obj, cls, genericType, anns, contentType,
-                               new MetadataMap<String, Object>(), os);
+                        new MetadataMap<>(), os);
             } catch (IOException ex) {
                 throw ExceptionUtils.toInternalServerErrorException(ex, null);
             }

diff --git a/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/JAXRSEntityPartTest.java b/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/JAXRSEntityPartTest.java
@@ -19,19 +19,23 @@
 
 package org.apache.cxf.systest.jaxrs;
 
+import java.io.ByteArrayOutputStream;
 import java.io.File;
+import java.io.IOException;
 import java.io.InputStream;
+import java.io.PrintWriter;
 import java.io.SequenceInputStream;
+import java.net.URISyntaxException;
 import java.nio.file.Files;
 import java.util.List;
 
 import jakarta.ws.rs.core.EntityPart;
 import jakarta.ws.rs.core.GenericType;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
+import org.apache.cxf.ext.logging.LoggingOutInterceptor;
 import org.apache.cxf.helpers.IOUtils;
 import org.apache.cxf.jaxrs.client.WebClient;
-import org.apache.cxf.jaxrs.utils.ParameterizedListType;
 import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
 
 import org.junit.BeforeClass;
@@ -49,8 +53,7 @@
 
 public class JAXRSEntityPartTest extends AbstractBusClientServerTestBase {
     public static final String PORT = EntityPartServer.PORT;
-    public static final String PORTINV = allocatePort(JAXRSEntityPartTest.class, 1);
-
+
     @BeforeClass
     public static void startServers() throws Exception {
         assertTrue("server did not launch correctly", launchServer(EntityPartServer.class, true));
@@ -59,33 +62,37 @@ public static void startServers() throws Exception {
 
     @Test
     public void testUploadImage() throws Exception {
+        this.uploadImage("/org/apache/cxf/systest/jaxrs/resources/java.jpg");
+    }
+
+    @Test
+    public void testUploadImageWithSemicolon() throws Exception {
+        this.uploadImage("/org/apache/cxf/systest/jaxrs/resources/java;test.jpg");
+    }
+
+    @Test
+    public void testContentDispositionInRequestIsWhitespaceSeparated() throws URISyntaxException, IOException {
         final File file = new File(getClass().getResource("/org/apache/cxf/systest/jaxrs/resources/java.jpg")
                 .toURI().getPath());
         final String address = "http://localhost:" + PORT + "/bookstore/books/images";
+
+        ByteArrayOutputStream output = new ByteArrayOutputStream();
+        PrintWriter writer = new PrintWriter(output, true);
+        LoggingOutInterceptor out = new LoggingOutInterceptor(writer);
+
         final WebClient client = WebClient.create(address);
+        client.getConfiguration().getOutInterceptors().add(out);
         client.type(MediaType.MULTIPART_FORM_DATA).accept(MediaType.MULTIPART_FORM_DATA);
 
         try (InputStream is = Files.newInputStream(file.toPath())) {
             final EntityPart part = EntityPart
-                .withFileName(file.getName())
-                .content(is)
-                .build();
-
-            try (Response response = client.postCollection(List.of(part), EntityPart.class)) {
-                assertThat(response.getStatus(), equalTo(200));
-
-                @SuppressWarnings("unchecked")
-                final List<EntityPart> parts = (List<EntityPart>) response
-                    .readEntity(new GenericType<>(new ParameterizedListType(EntityPart.class)));
-
-                assertThat(parts, hasSize(1));
-                assertThat(parts.get(0), is(not(nullValue())));
+                    .withFileName(file.getName())
+                    .content(is)
+                    .build();
 
-                assertThat(parts.get(0).getFileName().isPresent(), is(true));
-                assertThat(parts.get(0).getFileName().get(), equalTo(part.getFileName().get()));
-
-                assertArrayEquals(IOUtils.readBytesFromStream(parts.get(0).getContent()), 
-                    IOUtils.readBytesFromStream(Files.newInputStream(file.toPath())));
+            try (Response ignored = client.postCollection(List.of(part), EntityPart.class)) {
+                String expected = "Content-Disposition: form-data; name=\"file\"; filename=\"java.jpg\"";
+                assertTrue(output.toString().contains(expected));
             }
         }
     }
@@ -152,4 +159,35 @@ private static String stripXmlInstructionIfNeeded(String str) {
         }
         return str;
     }
+
+    private void uploadImage(String path) throws URISyntaxException, IOException {
+        final File file = new File(getClass().getResource(path)
+                .toURI().getPath());
+        final String address = "http://localhost:" + PORT + "/bookstore/books/images";
+
+        final WebClient client = WebClient.create(address);
+        client.type(MediaType.MULTIPART_FORM_DATA).accept(MediaType.MULTIPART_FORM_DATA);
+
+        try (InputStream is = Files.newInputStream(file.toPath())) {
+            final EntityPart part = EntityPart
+                    .withFileName(file.getName())
+                    .content(is)
+                    .build();
+
+            try (Response response = client.postCollection(List.of(part), EntityPart.class)) {
+                assertThat(response.getStatus(), equalTo(200));
+
+                final List<EntityPart> parts = response.readEntity(new GenericType<>() { });
+
+                assertThat(parts, hasSize(1));
+                assertThat(parts.get(0), is(not(nullValue())));
+
+                assertThat(parts.get(0).getFileName().isPresent(), is(true));
+                assertThat(parts.get(0).getFileName().get(), equalTo(part.getFileName().get()));
+
+                assertArrayEquals(IOUtils.readBytesFromStream(parts.get(0).getContent()),
+                        IOUtils.readBytesFromStream(Files.newInputStream(file.toPath())));
+            }
+        }
+    }
 }
diff --git a/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/JAXRSMultipartTest.java b/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/JAXRSMultipartTest.java
@@ -28,6 +28,7 @@
 import java.io.PrintWriter;
 import java.io.PushbackInputStream;
 import java.lang.annotation.Annotation;
+import java.net.URISyntaxException;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
@@ -94,7 +95,7 @@
 public class JAXRSMultipartTest extends AbstractBusClientServerTestBase {
     public static final String PORT = MultipartServer.PORT;
     public static final String PORTINV = allocatePort(JAXRSMultipartTest.class, 1);
-    
+
     @BeforeClass
     public static void startServers() throws Exception {
         assertTrue("server did not launch correctly",
@@ -104,8 +105,8 @@ public static void startServers() throws Exception {
         bus.setProperty(ProviderFactory.SKIP_JAKARTA_JSON_PROVIDERS_REGISTRATION, true);
     }
 
-    
-    
+
+
     @Test
     public void testBookAsRootAttachmentStreamSource() throws Exception {
         String address = "http://localhost:" + PORT + "/bookstore/books/stream";
@@ -529,7 +530,7 @@ public void attachmentIsNotWrappedIntoAnotherAttachment() throws Exception {
     }
 
     @Test
-    public void testNullPartProxy() throws Exception {
+    public void testNullPartProxy() {
         ByteArrayOutputStream output = new ByteArrayOutputStream();
         PrintWriter writer = new PrintWriter(output, true);
 
@@ -539,8 +540,8 @@ public void testNullPartProxy() throws Exception {
             JAXRSClientFactory.create("http://localhost:" + PORT, MultipartStore.class);
         WebClient.getConfig(store).getOutInterceptors().add(out);
         assertEquals("nobody home2", store.testNullParts("value1", null));
-        String expected = "Content-Disposition: form-data;name=\"someid\"";
-        assertTrue(output.toString().indexOf(expected) != -1);
+        String expected = "Content-Disposition: form-data; name=\"someid\"";
+        assertTrue(output.toString().contains(expected));
     }
 
     @Test
@@ -1032,23 +1033,12 @@ public void testUploadFileWithSemicolonName() throws Exception {
 
     @Test
     public void testUploadImageFromForm2() throws Exception {
-        File file =
-            new File(getClass().getResource("/org/apache/cxf/systest/jaxrs/resources/java.jpg")
-                               .toURI().getPath());
-        String address = "http://localhost:" + PORT + "/bookstore/books/formimage2";
-        WebClient client = WebClient.create(address);
-        client.type("multipart/form-data").accept("multipart/form-data");
-        WebClient.getConfig(client).getRequestContext().put("support.type.as.multipart",
-                                                            "true");
-        MultipartBody body2 = client.post(file, MultipartBody.class);
-        InputStream is2 = body2.getRootAttachment().getDataHandler().getInputStream();
-        byte[] image1 = IOUtils.readBytesFromStream(
-            getClass().getResourceAsStream("/org/apache/cxf/systest/jaxrs/resources/java.jpg"));
-        byte[] image2 = IOUtils.readBytesFromStream(is2);
-        assertArrayEquals(image1, image2);
-        ContentDisposition cd2 = body2.getRootAttachment().getContentDisposition();
-        assertEquals("form-data;name=file;filename=java.jpg", cd2.toString());
-        assertEquals("java.jpg", cd2.getParameter("filename"));
+        this.uploadImageFromForm2("java.jpg");
+    }
+
+    @Test
+    public void testUploadImageFromForm2WithSemicolon() throws Exception {
+        this.uploadImageFromForm2("java;test.jpg");
     }
 
     @Test
@@ -1168,7 +1158,7 @@ public void testLargerThanDefaultHeader() throws Exception {
 
         Attachment att = new Attachment(headers, handler, null);
         try (Response response = client.post(att)) {
-            assertEquals(response.getStatus(), 200);
+            assertEquals(200, response.getStatus());
         }
 
         client.close();
@@ -1281,6 +1271,26 @@ private String stripXmlInstructionIfNeeded(String str) {
         return str;
     }
 
+    private void uploadImageFromForm2(String filename) throws URISyntaxException, IOException {
+        File file =
+                new File(getClass().getResource("/org/apache/cxf/systest/jaxrs/resources/" + filename)
+                        .toURI().getPath());
+        String address = "http://localhost:" + PORT + "/bookstore/books/formimage2";
+        WebClient client = WebClient.create(address);
+        client.type("multipart/form-data").accept("multipart/form-data");
+        WebClient.getConfig(client).getRequestContext().put("support.type.as.multipart",
+                "true");
+        MultipartBody body2 = client.post(file, MultipartBody.class);
+        InputStream is2 = body2.getRootAttachment().getDataHandler().getInputStream();
+        byte[] image1 = IOUtils.readBytesFromStream(
+                getClass().getResourceAsStream("/org/apache/cxf/systest/jaxrs/resources/" + filename));
+        byte[] image2 = IOUtils.readBytesFromStream(is2);
+        assertArrayEquals(image1, image2);
+        ContentDisposition cd2 = body2.getRootAttachment().getContentDisposition();
+        assertEquals("form-data; name=\"file\"; filename=\"" + filename + "\"", cd2.toString());
+        assertEquals(filename, cd2.getParameter("filename"));
+    }
+
     /**
      * Windows attachment handling
      */

diff --git a/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/resources/java;test.jpg b/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/resources/java;test.jpg