oscerd opened a new pull request, #25218:
URL: https://github.com/apache/camel/pull/25218

   Reduces externally-derived filenames to a leaf name (`FileUtil.stripPath`) 
before they are placed in the `CamelFileName` control header, so path segments 
carried by an archive/multipart name are not propagated to downstream file/ftp 
producers. This aligns these paths with the normalisation other file-producing 
paths already apply.
   
   ### What
   
   `CamelFileName` (`Exchange.FILE_NAME`) is consumed by file/ftp producers to 
choose the output filename. Three paths set it from an externally-derived name 
that may contain path segments:
   
   - **camel-platform-http-vertx** — `VertxPlatformHttpConsumer` set it from 
the raw multipart `Content-Disposition` filename (`upload.fileName()`).
   - **camel-zipfile** — `ZipFileDataFormat` / `ZipIterator` set it from the 
raw ZIP entry name.
   - **camel-tarfile** — `TarFileDataFormat` / `TarIterator` set it from the 
raw TAR entry name.
   
   Each now applies `FileUtil.stripPath(...)`. The **marshal** paths 
(`ZipFileDataFormat` / `TarFileDataFormat` output-filename headers, which are 
route-author-controlled) are intentionally left unchanged.
   
   ### Tests
   
   New `ZipFileNameStripPathTest` and `TarFileNameStripPathTest` assert that an 
entry name with a directory prefix (`subdir/evil.txt`) yields `CamelFileName = 
evil.txt` after unmarshal. The vertx multipart path uses the identical 
`FileUtil.stripPath` call.
   
   ### Notes
   
   - Non-breaking: legitimate leaf filenames are unaffected.
   - Improvement / consistency hardening — **not backported** (main only).
   - Full reactor build (`mvn clean install -DskipTests`) succeeds with no 
generated-file drift.
   
   ---
   _Claude Code on behalf of Andrea Cosentino (@oscerd)_
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to