[jira] [Created] (CAMEL-25634) camel-jetty - a text field of a multipart/form-data request that occurs several times (checkbox group, multi-select) is mapped to a header with only its first value; the other values are lost

["shashank (Jira)" <ji...@apache.org>]

shashank created CAMEL-25634:
--------------------------------

             Summary: camel-jetty - a text field of a multipart/form-data request that occurs several times (checkbox group, multi-select) is mapped to a header with only its first value; the other values are lost
                 Key: CAMEL-25634
                 URL: https://issues.apache.org/jira/browse/CAMEL-25634
             Project: Camel
          Issue Type: Bug
          Components: camel-jetty
            Reporter: shashank
            Assignee: shashank


With a multipart request, {{AttachmentHttpBinding.populateAttachments}} adds every part, text fields included, as an attachment keyed by the field name. {{populateRequestParameters}} then maps a parameter that has an attachment of type {{text/plain}} (or none) to a header with {{request.getParameter(name)}} (line 131 at main 1de5ec5135f8):
{code:java}
if (am.getAttachment(name) != null) {
    DataHandler dh = am.getAttachment(name);
    Object value = dh;
    if (dh.getContentType() == null || dh.getContentType().startsWith("text/plain")) {
        // prevent potential injections
        value = HttpHelper.sanitizeLog(request.getParameter(name));
    }
    ...appendHeader(headers, name, value);
    continue;
}
{code}
{{getParameter}} returns the first value only. A multipart form with {{tag=integration}}, {{project=Camel}}, {{tag=routing}} gives the header {{tag}} = {{integration}}; {{routing}} is lost. The parameters that are not attachments (query parameters, form-urlencoded fields) go through {{getParameterValues}} a few lines below and keep every value, and camel-platform-http-vertx and camel-undertow map the same multipart field to a list of both values (differential test, same request to each consumer). Default options ({{enableMultipartFilter}} is on).

h3. Reproduction

New {{MultiPartFormRepeatedFieldTest}}: with main it fails with {{expected: <[integration, routing]> but was: <integration>}}.

camel-jetty with the fix: 404 tests, 0 failures, 23 skipped, 1 error in {{JettyXsltHttpTemplateTest}} that fails the same way without the change on the test machine (it fetches a stylesheet from 0.0.0.0).

h3. Proposed fix

Map each value of {{request.getParameterValues(name)}} (sanitized as before) for a text part; a file part is mapped as before (its {{DataHandler}}).

Behaviour change (4.24 upgrade-guide entry): the header of a repeated multipart text field is a list of all values, as for a repeated query or form-urlencoded parameter.

Not changed: several file parts with the same field name still keep one attachment (attachments are keyed by name), as in the other consumers.

Affected: main 1de5ec5135f8 (tested). camel-4.23.x, camel-4.22.1 and camel-4.18.4 have the same line; camel-4.14.9 has {{value = request.getParameter(name);}} (without the sanitizing): read, not run.

Duplicate check (2026-10-14): JIRA text "jetty multipart parameter", "jetty multipart repeated": none; GitHub pull requests: none.

_Filed with Claude Code on behalf of allthingssecurity._




--
This message was sent by Atlassian Jira
(v8.20.10#820010)