Croway opened a new pull request, #1953: URL: https://github.com/apache/camel-spring-boot/pull/1953
Cherry-pick of #1897 onto `camel-spring-boot-4.22.x`. **Original PR:** #1897 — camel-platform-http-starter - align SpringBootPlatformHttpBinding multipart handling **JIRA:** [CAMEL-24496](https://issues.apache.org/jira/browse/CAMEL-24496) ### What it fixes `SpringBootPlatformHttpBinding` was checking `fileNameExtWhitelist` against the multipart field's key instead of the actual submitted file name, and doing a substring match on the comma-separated whitelist rather than matching whole tokens — both allow a crafted request to bypass the extension whitelist. When a whitelist was configured but the submitted name had no extension, the upload was allowed through rather than rejected. The fix moves the whitelist check ahead of `transferTo()`, so a rejected upload is never written to the servlet's temp directory in the first place, and makes the check fail closed (reject) when a whitelist is configured and the file name has no extension. It also applies `FileUtil.stripPath` to the value stored on `CamelFileName`, matching the path normalisation CAMEL-24293 already applied for the vertx, zipfile, and tarfile platform-http paths, closing a related header-injection style gap. ### Verification on this branch - Cherry-pick of `9f358abc006b5a12fd3157d14dfecb5713127dd9` applied cleanly, no conflicts. - No import/annotation drift — the cherry-picked test already used `org.apache.camel.test.spring.junit6.CamelSpringBootTest`, matching this branch's existing test style, so no changes were needed there. - Ran `mvn verify` on `components-starter/camel-platform-http-starter` (with the SNAPSHOT parent/camel-version temporarily repointed to the last released 4.22.0 for local resolution, reverted afterwards — no version-repoint changes are part of this PR). Full module build: 35 unit test classes, all green, plus the failsafe integration tests, all green. The new `SpringBootPlatformHttpFileNameExtWhitelistTest` passes: 7/7. - Module build (`install -am`) for `camel-platform-http-starter` succeeded. _Claude Code on behalf of Federico Mariani_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
