This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new c2bcb24814a8 CAMEL-24419: camel-mail - filter the mail session
property namespace on MimeMultipart unmarshal (#25568)
c2bcb24814a8 is described below
commit c2bcb24814a806ced928e612ce5da1a6e3658234
Author: Andrea Cosentino <[email protected]>
AuthorDate: Fri Aug 21 23:07:40 2026 +0200
CAMEL-24419: camel-mail - filter the mail session property namespace on
MimeMultipart unmarshal (#25568)
CAMEL-23522 extended MailHeaderFilterStrategy so the inbound path also
filters
the mail.smtp. and mail.smtps. prefixes, not just Camel*/camel*, so an
external
mail message cannot inject JavaMail session properties onto the exchange.
MimeMultipartDataFormat, which CAMEL-23891 gave a header filter for the
Camel*
namespace, still held a plain DefaultHeaderFilterStrategy. That strategy
only
knows Camel*/camel*, so the namespace CAMEL-23522 deliberately filters on
the
consumer path was not filtered by the headersInline unmarshal path.
Switches the data format to MailHeaderFilterStrategy so both entry points
agree
on the filtered namespace. The swap is confined to the inbound direction:
MailHeaderFilterStrategy.initialize() only calls setInFilterStartsWith(),
so the
out filter keeps the DefaultHeaderFilterStrategy default, and the strategy
is
used at exactly one site in the data format (copyNonStandardHeaders, which
calls
applyFilterToExternalHeaders). Marshal behaviour is unchanged.
Adds a test next to the existing CAMEL-23891 one, and a 4.23 upgrade-guide
entry.
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
.../mime/multipart/MimeMultipartDataFormat.java | 4 ++--
.../multipart/MimeMultipartDataFormatTest.java | 22 ++++++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_23.adoc | 12 ++++++++++++
3 files changed, 36 insertions(+), 2 deletions(-)
diff --git
a/components/camel-mail/src/main/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormat.java
b/components/camel-mail/src/main/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormat.java
index c1606eae113d..edd685a537b1 100644
---
a/components/camel-mail/src/main/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormat.java
+++
b/components/camel-mail/src/main/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormat.java
@@ -50,10 +50,10 @@ import org.apache.camel.NoTypeConversionAvailableException;
import org.apache.camel.attachment.Attachment;
import org.apache.camel.attachment.AttachmentMessage;
import org.apache.camel.attachment.DefaultAttachment;
+import org.apache.camel.component.mail.MailHeaderFilterStrategy;
import org.apache.camel.spi.HeaderFilterStrategy;
import org.apache.camel.spi.annotations.Dataformat;
import org.apache.camel.support.DefaultDataFormat;
-import org.apache.camel.support.DefaultHeaderFilterStrategy;
import org.apache.camel.support.ExchangeHelper;
import org.apache.camel.support.MessageHelper;
import org.apache.camel.util.IOHelper;
@@ -74,7 +74,7 @@ public class MimeMultipartDataFormat extends
DefaultDataFormat {
private String includeHeaders;
private Pattern includeHeadersPattern;
private boolean binaryContent;
- private final HeaderFilterStrategy headerFilterStrategy = new
DefaultHeaderFilterStrategy();
+ private final HeaderFilterStrategy headerFilterStrategy = new
MailHeaderFilterStrategy();
public String getMultipartSubType() {
return multipartSubType;
diff --git
a/components/camel-mail/src/test/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormatTest.java
b/components/camel-mail/src/test/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormatTest.java
index d88a5d4226f1..d81cebb3fd6c 100644
---
a/components/camel-mail/src/test/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormatTest.java
+++
b/components/camel-mail/src/test/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormatTest.java
@@ -40,6 +40,7 @@ import org.apache.camel.util.IOHelper;
import org.junit.jupiter.api.Disabled;
import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
import static org.junit.jupiter.api.Assertions.assertArrayEquals;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
@@ -427,6 +428,27 @@ public class MimeMultipartDataFormatTest extends
CamelTestSupport {
assertNull(out.getMessage().getHeader("CAMELBaz"));
}
+ @Test
+ void unmarshalInlineHeadersFiltersMailSessionPropertyHeaders() {
+ // MailHeaderFilterStrategy adds the mail.smtp. / mail.smtps. prefixes
to the inbound filter
+ // (CAMEL-23522) so an external mail message cannot inject JavaMail
session properties. The
+ // headersInline unmarshal path has to filter the same namespace as
the mail consumer does.
+ String mime = "mail.smtp.host: blocked\r\n"
+ + "mail.smtps.auth: blocked\r\n"
+ + "MAIL.SMTP.PORT: blocked\r\n"
+ + "X-Normal: keep-me\r\n"
+ + "Content-Type: text/plain\r\n"
+ + "\r\n"
+ + "Body text";
+ in.setBody(mime);
+ Exchange out = template.send("direct:unmarshalonlyinlineheaders",
exchange);
+ assertThat(out.getMessage()).isNotNull();
+
assertThat(out.getMessage().getHeader("X-Normal")).isEqualTo("keep-me");
+ assertThat(out.getMessage().getHeader("mail.smtp.host")).isNull();
+ assertThat(out.getMessage().getHeader("mail.smtps.auth")).isNull();
+ assertThat(out.getMessage().getHeader("MAIL.SMTP.PORT")).isNull();
+ }
+
@Test
public void unmarshalRelated() throws IOException {
in.setBody(new File("src/test/resources/multipart-related.txt"));
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
index 9dd0869b124d..55eb73cbb500 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
@@ -81,6 +81,18 @@ Applications that aggregate classes outside the default
whitelist through the re
without supplying their own `hazelcastInstance` must now provide a `Config`
with a
`JavaSerializationFilterConfig` covering their class names.
+=== camel-mail
+
+`MimeMultipartDataFormat` now uses `MailHeaderFilterStrategy` instead of a
plain
+`DefaultHeaderFilterStrategy` when `headersInline` unmarshal copies the
remaining MIME headers onto
+the Camel message. That strategy filters the `mail.smtp.` and `mail.smtps.`
prefixes on the inbound
+path in addition to `Camel*`/`camel*`, so the data format now filters the same
namespace the mail
+consumer has filtered since 4.14.9/4.18.4/4.22.0.
+
+Routes that relied on `mail.smtp.*` or `mail.smtps.*` headers arriving on the
exchange from an
+unmarshalled MIME message must set those values explicitly on the route
instead. Ordinary
+application headers are unaffected.
+
=== camel-netty - object codecs apply a deserialization filter by default
The `ObjectDecoder` and `DatagramPacketObjectDecoder` codecs (used when a
route configures Netty
