Croway opened a new pull request, #1952: URL: https://github.com/apache/camel-spring-boot/pull/1952
Cherry-pick of #1897 onto `camel-spring-boot-4.18.x`. **Original PR:** #1897 — camel-platform-http-starter - align SpringBootPlatformHttpBinding multipart handling **JIRA:** [CAMEL-24496](https://issues.apache.org/jira/browse/CAMEL-24496) ### What it fixes `SpringBootPlatformHttpBinding` was checking `fileNameExtWhitelist` against the multipart field's key instead of the actual submitted file name, and doing a substring match on the comma-separated whitelist rather than matching whole tokens — both allow a crafted request to bypass the extension whitelist. When a whitelist was configured but the submitted name had no extension, the upload was allowed through rather than rejected. The fix moves the whitelist check ahead of `transferTo()`, so a rejected upload is never written to the servlet's temp directory in the first place, and makes the check fail closed (reject) when a whitelist is configured and the file name has no extension. It also applies `FileUtil.stripPath` to the value stored on `CamelFileName`, matching the path normalisation CAMEL-24293 already applied for the vertx, zipfile, and tarfile platform-http paths, closing a related header-injection style gap. ### Verification on this branch - Cherry-pick of `9f358abc006b5a12fd3157d14dfecb5713127dd9` applied cleanly (git auto-merge, no conflicts). - The cherry-picked test used `org.apache.camel.test.spring.junit6.CamelSpringBootTest`, which doesn't exist on this branch (4.18.x is Spring Boot 3 / JUnit 5). Changed the import to `org.apache.camel.test.spring.junit5.CamelSpringBootTest` to match every other test in this module on this branch — no assertions or test semantics were changed. - Ran `mvn verify` on `components-starter/camel-platform-http-starter` (with the SNAPSHOT parent/camel-version temporarily repointed to the last released 4.18.4 for local resolution, reverted afterwards — no version-repoint changes are part of this PR). The new `SpringBootPlatformHttpFileNameExtWhitelistTest` passes: 7/7. Two unrelated tests (`SpringBootPlatformHttpCookiesTest.echoCookie`, `SpringBootPlatformHttpRequestTimeoutTest.testGetAsync`) failed; I confirmed these fail identically on the pre-cherry-pick commit of this branch, so they're pre-existing local-environment flakiness, not caused by this change. - Module build (`install -am`) for `camel-platform-http-starter` succeeded. _Claude Code on behalf of Federico Mariani_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
