[jira] [Updated] (CAMEL-24650) camel-http-common: lift the multipart fileNameExtWhitelist check into DefaultHttpBinding

["Claus Ibsen (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24650?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Claus Ibsen updated CAMEL-24650:
--------------------------------
    Fix Version/s: 4.18.5

> camel-http-common: lift the multipart fileNameExtWhitelist check into DefaultHttpBinding
> ----------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24650
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24650
>             Project: Camel
>          Issue Type: Improvement
>          Components: camel-http-common
>            Reporter: Andrea Cosentino
>            Priority: Minor
>             Fix For: 4.18.5, 4.23.0
>
>
> Follow-up from the review of CAMEL-24427. The fileNameExtWhitelist enforcement for multipart uploads is currently implemented in three places that must be kept in sync: camel-servlet's AttachmentHttpBinding (inline), camel-jetty's AttachmentHttpBinding (isFileNameAccepted), and VertxPlatformHttpConsumer. Both servlet and jetty bindings extend DefaultHttpBinding, so the check could be lifted into DefaultHttpBinding (in camel-http-common) and reused, leaving a single implementation and preventing future drift.
> While there, consider the FileUtil.onlyExt multi-dot behaviour: it returns everything after the first dot (non-single mode), so archive.tar.gz yields tar.gz and a whitelist of gz rejects it - decide whether last-extension matching (onlyExt(name, true)) is more appropriate. Pre-existing behaviour mirrored across the three copies; out of scope for CAMEL-24427.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)