[jira] [Updated] (CAMEL-24427) camel-servlet, camel-jetty - fileNameExtWhitelist is checked against the wrong value in one binding and absent in the other

["Andrea Cosentino (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24427?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andrea Cosentino updated CAMEL-24427:
-------------------------------------
    Fix Version/s: 4.18.5

Adding fixVersion 4.18.5: the camel-4.18.x backport https://github.com/apache/camel/pull/26321 (commit d2a6b0269bf3) merged on 2026-09-11, after 4.18.4 shipped, so it is released with 4.18.5.

_Claude Code on behalf of oscerd_

> camel-servlet, camel-jetty - fileNameExtWhitelist is checked against the wrong value in one binding and absent in the other
> ---------------------------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24427
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24427
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-servlet
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.18.5, 4.22.1, 4.23.0
>
>
> The three HTTP server components that accept multipart uploads disagree about the upload filename check.
> camel-servlet AttachmentHttpBinding.populateAttachments():
> {code:java}
> for (Part part : parts) {
>     String fileName = part.getName();
>     // is the file name accepted
>     boolean accepted = true;
>     if (getFileNameExtWhitelist() != null) {
>         String ext = FileUtil.onlyExt(fileName);
> {code}
> Part.getName() returns the multipart *field* name, not the submitted file name (that is Part.getSubmittedFileName()). A field named for example "file" has no extension, so FileUtil.onlyExt returns null, accepted stays true, and the whitelist never rejects anything.
> camel-jetty jetty12/AttachmentHttpBinding.populateAttachments() has no whitelist check at all, although the option is exposed on the binding.
> camel-platform-http-vertx VertxPlatformHttpConsumer checks the real filename and is the correct reference implementation.
> Proposal: make camel-servlet check part.getSubmittedFileName(), and apply the same check in the camel-jetty binding. Add a test per component asserting a disallowed extension is rejected and an allowed one accepted.
> Separately, the camel-jetty binding also looks up the attachment by the submitted file name while it was stored under the field name, then passes that name to HttpHelper.appendHeader - so an attachment filename ends up as a header name. Worth addressing in the same change.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)