[
https://issues.apache.org/jira/browse/CAMEL-24427?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18112810#comment-18112810
]
Andrea Cosentino commented on CAMEL-24427:
------------------------------------------
Fixed via https://github.com/apache/camel/pull/26189 (merged to main as
fd120518ecbd591b05853434225587d2bd76b2fd).
camel-servlet now checks the whitelist against Part.getSubmittedFileName()
instead of Part.getName(), and camel-jetty applies the same check, which it
previously did not perform at all. The camel-jetty binding also no longer looks
the attachment up by the submitted file name while it was stored under the
field name, so a client-supplied file name can no longer become a header name.
Review additions: the whitelist is matched per comma-separated extension
exactly rather than as a substring, and the client-controlled file name is
passed through HttpHelper.sanitizeLog before being logged (CWE-117).
Follow-ups tracked in CAMEL-24652: consolidating the check into
DefaultHttpBinding so it exists once rather than three times, the
FileUtil.onlyExt non-single-mode behaviour (archive.tar.gz yields tar.gz), and
aligning camel-platform-http-vertx which still uses the substring form.
_Claude Code on behalf of oscerd_
> camel-servlet, camel-jetty - fileNameExtWhitelist is checked against the
> wrong value in one binding and absent in the other
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24427
> URL: https://issues.apache.org/jira/browse/CAMEL-24427
> Project: Camel
> Issue Type: Bug
> Components: camel-servlet
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> The three HTTP server components that accept multipart uploads disagree about
> the upload filename check.
> camel-servlet AttachmentHttpBinding.populateAttachments():
> {code:java}
> for (Part part : parts) {
> String fileName = part.getName();
> // is the file name accepted
> boolean accepted = true;
> if (getFileNameExtWhitelist() != null) {
> String ext = FileUtil.onlyExt(fileName);
> {code}
> Part.getName() returns the multipart *field* name, not the submitted file
> name (that is Part.getSubmittedFileName()). A field named for example "file"
> has no extension, so FileUtil.onlyExt returns null, accepted stays true, and
> the whitelist never rejects anything.
> camel-jetty jetty12/AttachmentHttpBinding.populateAttachments() has no
> whitelist check at all, although the option is exposed on the binding.
> camel-platform-http-vertx VertxPlatformHttpConsumer checks the real filename
> and is the correct reference implementation.
> Proposal: make camel-servlet check part.getSubmittedFileName(), and apply the
> same check in the camel-jetty binding. Add a test per component asserting a
> disallowed extension is rejected and an allowed one accepted.
> Separately, the camel-jetty binding also looks up the attachment by the
> submitted file name while it was stored under the field name, then passes
> that name to HttpHelper.appendHeader - so an attachment filename ends up as a
> header name. Worth addressing in the same change.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
