oscerd opened a new pull request, #25218: URL: https://github.com/apache/camel/pull/25218
Reduces externally-derived filenames to a leaf name (`FileUtil.stripPath`) before they are placed in the `CamelFileName` control header, so path segments carried by an archive/multipart name are not propagated to downstream file/ftp producers. This aligns these paths with the normalisation other file-producing paths already apply. ### What `CamelFileName` (`Exchange.FILE_NAME`) is consumed by file/ftp producers to choose the output filename. Three paths set it from an externally-derived name that may contain path segments: - **camel-platform-http-vertx** — `VertxPlatformHttpConsumer` set it from the raw multipart `Content-Disposition` filename (`upload.fileName()`). - **camel-zipfile** — `ZipFileDataFormat` / `ZipIterator` set it from the raw ZIP entry name. - **camel-tarfile** — `TarFileDataFormat` / `TarIterator` set it from the raw TAR entry name. Each now applies `FileUtil.stripPath(...)`. The **marshal** paths (`ZipFileDataFormat` / `TarFileDataFormat` output-filename headers, which are route-author-controlled) are intentionally left unchanged. ### Tests New `ZipFileNameStripPathTest` and `TarFileNameStripPathTest` assert that an entry name with a directory prefix (`subdir/evil.txt`) yields `CamelFileName = evil.txt` after unmarshal. The vertx multipart path uses the identical `FileUtil.stripPath` call. ### Notes - Non-breaking: legitimate leaf filenames are unaffected. - Improvement / consistency hardening — **not backported** (main only). - Full reactor build (`mvn clean install -DskipTests`) succeeds with no generated-file drift. --- _Claude Code on behalf of Andrea Cosentino (@oscerd)_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
