oscerd commented on code in PR #26189:
URL: https://github.com/apache/camel/pull/26189#discussion_r3957444620
##########
components/camel-jetty/src/main/java/org/apache/camel/component/jetty12/AttachmentHttpBinding.java:
##########
@@ -67,23 +79,42 @@ protected void populateAttachments(HttpServletRequest
request, Message message)
}
}
AttachmentMessage am = new
DefaultAttachmentMessage(message);
- am.addAttachmentObject(part.getName(), attachment);
- String name = part.getSubmittedFileName();
- Object value = am.getAttachment(name);
- Map<String, Object> headers = message.getHeaders();
- if (getHeaderFilterStrategy() != null
- &&
!getHeaderFilterStrategy().applyFilterToExternalHeaders(name, value,
message.getExchange())
- && name != null) {
- HttpHelper.appendHeader(headers, name, value);
+ String name = part.getName();
+ am.addAttachmentObject(name, attachment);
+ // a file part is also exposed as a header carrying the
DataHandler. The attachment is keyed on
+ // the multipart field name, so the header must be looked
up and named by that same key and not
+ // by the client supplied file name. A plain form field
carries no file name and is mapped by
+ // populateRequestParameters instead, so it is left alone
here.
+ if (fileName != null && name != null) {
+ Object value = am.getAttachment(name);
+ Map<String, Object> headers = message.getHeaders();
+ if (getHeaderFilterStrategy() != null
+ &&
!getHeaderFilterStrategy().applyFilterToExternalHeaders(name, value,
+ message.getExchange())) {
+ HttpHelper.appendHeader(headers, name, value);
+ }
}
-
}
} catch (Exception e) {
throw new RuntimeCamelException("Cannot populate attachments",
e);
}
}
}
+ private boolean isFileNameAccepted(String fileName) {
+ String whitelist = getFileNameExtWhitelist();
+ if (whitelist == null) {
+ return true;
+ }
+ String ext = FileUtil.onlyExt(fileName);
+ if (ext == null) {
+ return true;
+ }
+ ext = ext.toLowerCase(Locale.US);
+ whitelist = whitelist.toLowerCase(Locale.US);
+ return whitelist.equals("*") || whitelist.contains(ext);
Review Comment:
Split into two, as suggested.
**The substring match** is fixed here, because this PR is what makes it
reachable: both bindings now split the whitelist on `,` and compare each token
exactly, so `fileNameExtWhitelist=txt` no longer accepts `evil.x`. A
substring-bypass test was added in both modules.
**The remaining two points** — the `FileUtil.onlyExt` non-single-mode
behaviour (`archive.tar.gz` yielding `tar.gz`), and lifting the check into
`DefaultHttpBinding` so there is one implementation rather than three — are
tracked in [CAMEL-24652](https://issues.apache.org/jira/browse/CAMEL-24652).
`camel-platform-http-vertx` still uses the substring form and is covered there
too. Changing the extension parsing is a behaviour change and needs its own
upgrade-guide entry, so it did not belong in this PR.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
