quarkusio/quarkus · error · ErrorDataDecoderException

Error decoding filename* attribute (wrapped ArrayIndexOutOfB

Error message

Error decoding filename* attribute (wrapped ArrayIndexOutOfBoundsException/UnsupportedCharsetException)

What it means

This ErrorDataDecoderException wraps ArrayIndexOutOfBoundsException or UnsupportedCharsetException raised while decoding an RFC 5987-style filename* (filename-encoded) disposition parameter. The value must look like charset'lang'%encoded-value; splitting on quotes requires exactly 3 segments, and the charset prefix must be a known charset. Malformed syntax or an unknown charset aborts the decode.

Source

Thrown at independent-projects/resteasy-reactive/client/runtime/src/main/java/org/jboss/resteasy/reactive/client/impl/multipart/QuarkusMultipartResponseDecoder.java:850

        String name = cleanString(values[0]);
        String value = values[1];

        // Filename can be token, quoted or encoded. See https://tools.ietf.org/html/rfc5987
        if (HttpHeaderValues.FILENAME.contentEquals(name)) {
            // Value is quoted or token. Strip if quoted:
            int last = value.length() - 1;
            if (last > 0 &&
                    value.charAt(0) == HttpConstants.DOUBLE_QUOTE &&
                    value.charAt(last) == HttpConstants.DOUBLE_QUOTE) {
                value = value.substring(1, last);
            }
        } else if (FILENAME_ENCODED.equals(name)) {
            try {
                name = HttpHeaderValues.FILENAME.toString();
                String[] split = cleanString(value).split("'", 3);
                value = QueryStringDecoder.decodeComponent(split[2], Charset.forName(split[0]));
            } catch (ArrayIndexOutOfBoundsException | UnsupportedCharsetException e) {
                throw new ErrorDataDecoderException(e);
            }
        } else {
            // otherwise we need to clean the value
            value = cleanString(value);
        }
        return factory.createAttribute(response, name, value);
    }

    /**
     * Get the FileUpload (new one or current one)
     *
     * @param delimiter
     *        the delimiter to use
     * @return the InterfaceHttpData if any
     * @throws ErrorDataDecoderException on decoder error
     */
    protected InterfaceHttpData getFileUpload(String delimiter) {
        // eventually restart from existing FileUpload

View on GitHub (pinned to e1c734241f)

Solutions

Fix the server to emit the full RFC 5987 syntax: filename*=UTF-8''My%20File.txt.
Use a standard charset label (UTF-8, ISO-8859-1) in filename*.
If only the percent-encoded name is sent, switch the server to a plain filename parameter instead.
Keep filename ASCII-only so filename* is not needed at all.

Example fix

// before (missing charset/lang segments)
filename*=My%20File.txt
// after
filename*=UTF-8''My%20File.txt

Defensive patterns

Strategy: validation

Validate before calling

// Validate RFC 5987 filename* syntax before sending
Pattern F = Pattern.compile("^[A-Za-z0-9-]+'[^']*'.+");
if (!F.matcher(filenameStar).matches() || !Charset.isSupported(filenameStar.split("'")[0])) {
    throw new IllegalStateException("filename* must be charset'lang'percent-encoded-value with a supported charset");
}

Type guard

static boolean isValidFilenameStar(String v) {
    String[] parts = v == null ? new String[0] : v.split("'", 3);
    return parts.length == 3 && !parts[0].isBlank() && Charset.isSupported(parts[0]);
}

Try / catch

try {
    return decodeDisposition(name, value);
} catch (ErrorDataDecoderException e) {
    log.warn("filename* decode failed (cause={})", e.getCause(), e);
    return fallbackToPlainFilename(name, value); // e.g. use ASCII 'filename' instead
}

Prevention

Always emit filename* as charset''percent-encoded-value (UTF-8''...).
Prefer plain ASCII filename to avoid filename* entirely.
Verify charset labels against Charset.isSupported for your target JVM.
Encode only the value segment; keep quotes count exactly two.

When it happens

Trigger: A filename* parameter value does not have the charset'lang'value shape (fewer than 3 quote-separated segments -> ArrayIndexOutOfBoundsException) or declares a charset unknown to the JVM (Charset.forName throws -> UnsupportedCharsetException).

Common situations: Servers emitting filename* without the charset'' prefix (just the percent-encoded name); exotic charset labels like 'cp437' unavailable in some JVM distributions; middlewares stripping quotes incorrectly.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/cda48646a29b6f59. Report an issue: GitHub.