gnodet-bot commented on code in PR #28358:
URL: https://github.com/apache/camel/pull/28358#discussion_r4360633637


##########
components/camel-mail/src/main/java/org/apache/camel/component/mail/MailConverters.java:
##########
@@ -112,6 +113,28 @@ public static String toString(Multipart multipart) throws 
MessagingException, IO
         return null;
     }
 
+    private static String contentToString(Part part, Object content) throws 
MessagingException, IOException {
+        if (content instanceof InputStream is && part.isMimeType("text/*")) {
+            // a text type Jakarta Mail has no content handler for, such as 
text/csv or text/calendar
+            try (is) {

Review Comment:
   ⚠️ **Potential OOM for large text attachments** — `readAllBytes()` loads the 
entire attachment body into a heap byte array.
   
   The guard `part.isMimeType("text/*")` limits this to text parts, but 
`text/csv` or `text/calendar` files can be arbitrarily large. For a Camel route 
processing mail with large CSV attachments, this could exhaust heap.
   
   Consider streaming into a `ByteArrayOutputStream` with a reasonable size 
limit, or documenting the constraint explicitly so callers are aware. 
Alternatively, `InputStreamCache` (already used elsewhere in Camel Mail) would 
allow overflow to disk.



##########
components/camel-mail/src/main/java/org/apache/camel/component/mail/MailConverters.java:
##########
@@ -98,7 +99,7 @@ public static String toString(Multipart multipart) throws 
MessagingException, IO
                 // Perform a case-insensitive "startsWith" check that works 
for different locales
                 String prefix = "text";
                 if (part.getContentType().regionMatches(true, 0, prefix, 0, 
prefix.length())) {
-                    return content.toString();
+                    return contentToString(part, content);
                 }
             }
         } catch (MessagingException e) {

Review Comment:
   ⚠️ **Silent exception swallowing** — this `catch (MessagingException e)` 
block discards the exception with no logging:
   
   ```java
   } catch (MessagingException e) {
       return null;
   }
   ```
   
   If Jakarta Mail throws during iteration of the multipart parts, the caller 
gets a silent `null` with no indication that something went wrong. Consider at 
least logging at WARN or DEBUG level, e.g.:
   
   ```suggestion
           } catch (MessagingException e) {
               LOG.warn("Failed to read multipart content, returning null", e);
               return null;
           }
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to