[
https://issues.apache.org/jira/browse/CAMEL-24650?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18119028#comment-18119028
]
Urmila Unni commented on CAMEL-24650:
-------------------------------------
I'd like to work on this.
Plan: move the whitelist check into DefaultHttpBinding as a shared method and
reuse it from the camel-servlet and camel-jetty AttachmentHttpBinding classes,
with no behavior change. It will keep the submitted-file-name check, exact
per-extension matching and sanitized logging from CAMEL-24427, and the existing
MultipartUploadFileNameExtWhitelistTest and
MultiPartFormFileNameExtWhitelistTest should pass unchanged.
VertxPlatformHttpConsumer would stay as is, since it doesn't extend
DefaultHttpBinding. I'll leave the onlyExt multi-dot question out of scope
unless you'd like it included.
> camel-http-common: lift the multipart fileNameExtWhitelist check into
> DefaultHttpBinding
> ----------------------------------------------------------------------------------------
>
> Key: CAMEL-24650
> URL: https://issues.apache.org/jira/browse/CAMEL-24650
> Project: Camel
> Issue Type: Improvement
> Components: camel-http-common
> Reporter: Andrea Cosentino
> Priority: Minor
>
> Follow-up from the review of CAMEL-24427. The fileNameExtWhitelist
> enforcement for multipart uploads is currently implemented in three places
> that must be kept in sync: camel-servlet's AttachmentHttpBinding (inline),
> camel-jetty's AttachmentHttpBinding (isFileNameAccepted), and
> VertxPlatformHttpConsumer. Both servlet and jetty bindings extend
> DefaultHttpBinding, so the check could be lifted into DefaultHttpBinding (in
> camel-http-common) and reused, leaving a single implementation and preventing
> future drift.
> While there, consider the FileUtil.onlyExt multi-dot behaviour: it returns
> everything after the first dot (non-single mode), so archive.tar.gz yields
> tar.gz and a whitelist of gz rejects it - decide whether last-extension
> matching (onlyExt(name, true)) is more appropriate. Pre-existing behaviour
> mirrored across the three copies; out of scope for CAMEL-24427.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
