Andrea Cosentino created CAMEL-24650:
----------------------------------------
Summary: camel-http-common: lift the multipart
fileNameExtWhitelist check into DefaultHttpBinding
Key: CAMEL-24650
URL: https://issues.apache.org/jira/browse/CAMEL-24650
Project: Camel
Issue Type: Improvement
Components: camel-http-common
Reporter: Andrea Cosentino
Follow-up from the review of CAMEL-24427. The fileNameExtWhitelist enforcement
for multipart uploads is currently implemented in three places that must be
kept in sync: camel-servlet's AttachmentHttpBinding (inline), camel-jetty's
AttachmentHttpBinding (isFileNameAccepted), and VertxPlatformHttpConsumer. Both
servlet and jetty bindings extend DefaultHttpBinding, so the check could be
lifted into DefaultHttpBinding (in camel-http-common) and reused, leaving a
single implementation and preventing future drift.
While there, consider the FileUtil.onlyExt multi-dot behaviour: it returns
everything after the first dot (non-single mode), so archive.tar.gz yields
tar.gz and a whitelist of gz rejects it - decide whether last-extension
matching (onlyExt(name, true)) is more appropriate. Pre-existing behaviour
mirrored across the three copies; out of scope for CAMEL-24427.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
