[
https://issues.apache.org/jira/browse/CAMEL-24650?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen updated CAMEL-24650:
--------------------------------
Fix Version/s: 4.22.2
> camel-http-common: lift the multipart fileNameExtWhitelist check into
> DefaultHttpBinding
> ----------------------------------------------------------------------------------------
>
> Key: CAMEL-24650
> URL: https://issues.apache.org/jira/browse/CAMEL-24650
> Project: Camel
> Issue Type: Improvement
> Components: camel-http-common
> Reporter: Andrea Cosentino
> Priority: Minor
> Fix For: 4.18.5, 4.22.2, 4.23.0
>
>
> Follow-up from the review of CAMEL-24427. The fileNameExtWhitelist
> enforcement for multipart uploads is currently implemented in three places
> that must be kept in sync: camel-servlet's AttachmentHttpBinding (inline),
> camel-jetty's AttachmentHttpBinding (isFileNameAccepted), and
> VertxPlatformHttpConsumer. Both servlet and jetty bindings extend
> DefaultHttpBinding, so the check could be lifted into DefaultHttpBinding (in
> camel-http-common) and reused, leaving a single implementation and preventing
> future drift.
> While there, consider the FileUtil.onlyExt multi-dot behaviour: it returns
> everything after the first dot (non-single mode), so archive.tar.gz yields
> tar.gz and a whitelist of gz rejects it - decide whether last-extension
> matching (onlyExt(name, true)) is more appropriate. Pre-existing behaviour
> mirrored across the three copies; out of scope for CAMEL-24427.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
