You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "oscerd (via GitHub)" <gi...@apache.org> on 2026/10/01 09:39:25 UTC
[PR] CAMEL-24652: camel-http-base, camel-http-common, camel-platform-http-vertx - one fileNameExtWhitelist check [camel]
oscerd opened a new pull request, #27194:
URL: https://github.com/apache/camel/pull/27194
## Problem
`fileNameExtWhitelist` had copies of its accept check that had drifted. `DefaultHttpBinding` (the base
for `camel-servlet` and `camel-jetty`) compares each comma-separated extension token **exactly**, but
`VertxPlatformHttpConsumer` still used the loose substring form:
```java
if (!fileNameExtWhitelist.equals("*") && !fileNameExtWhitelist.contains(ext)) {
accepted = false;
}
```
So with `fileNameExtWhitelist=txt`, a platform-http-vertx upload named `evil.x`, `evil.t` or `evil.tx`
was accepted, because `"txt".contains("x")`.
## Change
One implementation — `HttpHelper.isFileNameExtWhitelisted(whitelist, fileName)` in **camel-http-base**,
the only module reachable by both the http-common bindings and the vertx consumer:
- `DefaultHttpBinding.isFileNameAccepted` delegates to it. Behaviour unchanged: exact, case-insensitive,
comma-separated token match; `*` accepts everything; a name with no extension is accepted; the
configured whitelist value is left unmodified.
- `VertxPlatformHttpConsumer` calls it in place of the substring check. Uploads that only matched as a
substring are now rejected on the vertx consumer too.
This is the behaviour already documented for platform-http in the 4.23 upgrade guide
(*camel-platform-http-starter enforces fileNameExtWhitelist* — "matches whole comma-separated extension
tokens instead of testing for a substring"); the vertx consumer was still doing the substring match
despite that note, so no new upgrade-guide entry is added.
### onlyExt stays non-single (deliberate)
The extension is still taken with `FileUtil.onlyExt` (not single mode), so a multi-dot name is matched on
its **full extension chain**: `archive.tar.gz` needs a whitelist of `tar.gz`, not `gz`. Keeping this is a
security choice — single mode (last extension only) would let a double-extension upload such as
`evil.php.jpg` pass a `jpg` whitelist. The stricter behaviour is kept rather than relaxed.
## Tests
`HttpHelperFileNameExtWhitelistTest` (camel-http-base): null / `*` / no-extension / exact /
substring-bypass / comma-separated / case-insensitive / multi-dot chain / double-extension. Revert-to-red
verified (restoring the `contains()` form re-accepts `evil.x`).
`mvn clean install -pl components/camel-http-base` and
`mvn clean test -pl components/camel-http-common,components/camel-platform-http-vertx` green. No metadata
change → no catalog/DSL regeneration.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24652: camel-http-base, camel-http-common, camel-platform-http-vertx - one fileNameExtWhitelist check [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #27194:
URL: https://github.com/apache/camel/pull/27194#issuecomment-5928827158
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24652: camel-http-base, camel-http-common, camel-platform-http-vertx - one fileNameExtWhitelist check [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #27194:
URL: https://github.com/apache/camel/pull/27194#issuecomment-5929033931
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `components/camel-http-base`
- `components/camel-http-common`
- `components/camel-platform-http-vertx`
> :information_source: Dependent modules were not tested because the total number of affected modules exceeded the threshold (50). Use the `test-dependents` label to force testing all dependents.
---
<details><summary>:microscope: Scalpel shadow comparison — Scalpel: 80 of 697 tested, 27 compile-only — current: 80 all tested</summary>
[Maveniverse Scalpel](https://github.com/maveniverse/scalpel) detected **80 affected modules** (current approach: 80).
**Skip-tests mode would test 80 modules** (3 direct + 77 downstream), **skip tests for 27** (generated code, meta-modules)
<details><summary>Modules Scalpel would test (80)</summary>
- `camel-a2a` ← downstream of org.apache.camel:camel-platform-http-vertx
- `camel-ai-observability` ← downstream of org.apache.camel:camel-telemetry
- `camel-as2` ← downstream of org.apache.camel:camel-jetty
- `camel-atmosphere-websocket` ← downstream of org.apache.camel:camel-servlet
- `camel-clickup` ← downstream of org.apache.camel:camel-netty-http
- `camel-consul` ← downstream of org.apache.camel:camel-undertow
- `camel-cxf-common` ← downstream of org.apache.camel:camel-http-base
- `camel-cxf-rest` ← downstream of org.apache.camel:camel-http-base
- `camel-cxf-soap` ← downstream of org.apache.camel:camel-http-base
- `camel-cxf-spring-common` ← downstream of org.apache.camel:camel-http-base
- `camel-cxf-spring-rest` ← downstream of org.apache.camel:camel-undertow
- `camel-cxf-spring-soap` ← downstream of org.apache.camel:camel-undertow
- `camel-cxf-spring-transport` ← downstream of org.apache.camel:camel-cxf-spring-common
- `camel-cxf-transport` ← downstream of org.apache.camel:camel-http-common
- `camel-graphql` ← downstream of org.apache.camel:camel-http-base
- `camel-http` ← downstream of org.apache.camel:camel-http-common
- `camel-http-base` ← components/camel-http-base/src/main/java/org/apache/camel/http/base/HttpHelper.java, components/camel-http-base/src/test/java/org/apache/camel/http/base/HttpHelperFileNameExtWhitelistTest.java
- `camel-http-common` ← components/camel-http-common/src/main/java/org/apache/camel/http/common/DefaultHttpBinding.java
- `camel-java-joor-dsl` ← downstream of org.apache.camel:camel-telegram
- `camel-jbang-mcp` ← downstream of org.apache.camel:camel-yaml-dsl
- `camel-jbang-plugin-mcp` ← downstream of org.apache.camel:camel-jbang-core
- `camel-jbang-plugin-route-parser` ← downstream of org.apache.camel:camel-route-parser
- `camel-jbang-plugin-tui` ← downstream of org.apache.camel:camel-catalog
- `camel-jbang-plugin-validate` ← downstream of org.apache.camel:camel-jbang-core
- `camel-jetty` ← downstream of org.apache.camel:camel-http-common
- `camel-jetty-common` ← downstream of org.apache.camel:camel-http-common
- `camel-jsonpath` ← downstream of org.apache.camel:camel-platform-http-vertx
- `camel-kamelet` ← downstream of org.apache.camel:camel-http
- `camel-knative-http` ← downstream of org.apache.camel:camel-platform-http-vertx
- `camel-kubernetes` ← downstream of org.apache.camel:camel-http
- `camel-langchain4j-agent` ← downstream of org.apache.camel:camel-telemetry
- `camel-langchain4j-chat` ← downstream of org.apache.camel:camel-telemetry
- `camel-langchain4j-embeddings` ← downstream of org.apache.camel:camel-telemetry
- `camel-langchain4j-embeddingstore` ← downstream of org.apache.camel:camel-langchain4j-embeddings
- `camel-launcher-container` ← downstream of org.apache.camel:camel-launcher
- `camel-lra` ← downstream of org.apache.camel:camel-undertow
- `camel-mcp-server` ← downstream of org.apache.camel:camel-platform-http-vertx
- `camel-micrometer-observability` ← downstream of org.apache.camel:camel-undertow
- `camel-micrometer-prometheus` ← downstream of org.apache.camel:camel-platform-http-main
- `camel-netty-http` ← downstream of org.apache.camel:camel-http-base
- `camel-oauth` ← downstream of org.apache.camel:camel-vertx-http
- `camel-observability-services` ← downstream of org.apache.camel:camel-opentelemetry2
- `camel-openai` ← downstream of org.apache.camel:camel-platform-http-vertx
- `camel-openapi-validator` ← downstream of org.apache.camel:camel-http-base
- `camel-opentelemetry` ← downstream of org.apache.camel:camel-undertow
- `camel-opentelemetry2` ← downstream of org.apache.camel:camel-undertow
- `camel-platform-http` ← downstream of org.apache.camel:camel-http-base
- `camel-platform-http-jolokia` ← downstream of org.apache.camel:camel-platform-http
- `camel-platform-http-main` ← downstream of org.apache.camel:camel-platform-http-vertx
- `camel-platform-http-vertx` ← components/camel-platform-http-vertx/src/main/java/org/apache/camel/component/platform/http/vertx/VertxPlatformHttpConsumer.java
- `camel-quickfix` ← downstream of org.apache.camel:camel-jetty
- `camel-rest-openapi` ← downstream of org.apache.camel:camel-platform-http
- `camel-rest-postman` ← downstream of org.apache.camel:camel-platform-http
- `camel-restdsl-openapi-plugin` ← downstream of org.apache.camel:camel-platform-http
- `camel-sap-netweaver` ← downstream of org.apache.camel:camel-http
- `camel-semantic` ← downstream of org.apache.camel:camel-xml-io-dsl
- `camel-servlet` ← downstream of org.apache.camel:camel-http-common
- `camel-slack` ← downstream of org.apache.camel:camel-undertow
- `camel-soap` ← downstream of org.apache.camel:camel-cxf-soap
- `camel-spring-ai-chat` ← downstream of org.apache.camel:camel-telemetry
- `camel-spring-rabbitmq` ← downstream of org.apache.camel:camel-http
- `camel-state-store` ← downstream of org.apache.camel:camel-test-main-junit5
- `camel-telegram` ← downstream of org.apache.camel:camel-netty-http
- `camel-telemetry` ← downstream of org.apache.camel:camel-undertow
- `camel-telemetry-dev` ← downstream of org.apache.camel:camel-undertow
- `camel-test-main-junit5` ← downstream of org.apache.camel:camel-xml-io-dsl
- `camel-test-main-junit6` ← downstream of org.apache.camel:camel-xml-io-dsl
- `camel-typesafe-ai` ← downstream of org.apache.camel:camel-xml-io-dsl
- `camel-undertow` ← downstream of org.apache.camel:camel-http-base
- `camel-undertow-spring-security` ← downstream of org.apache.camel:camel-undertow
- `camel-vertx-http` ← downstream of org.apache.camel:camel-http-base
- `camel-webhook` ← downstream of org.apache.camel:camel-netty-http
- `camel-whatsapp` ← downstream of org.apache.camel:camel-netty-http
- `camel-xml-io-dsl` ← downstream of org.apache.camel:camel-telegram
- `camel-xml-jaxb-dsl` ← downstream of org.apache.camel:camel-telegram
- `camel-xml-jaxb-dsl-test-definition` ← downstream of org.apache.camel:camel-telegram
- `camel-xml-jaxb-dsl-test-spring` ← downstream of org.apache.camel:camel-telegram
- `camel-yaml-dsl-validator` ← downstream of org.apache.camel:camel-yaml-dsl
- `camel-yaml-dsl-validator-maven-plugin` ← downstream of org.apache.camel:camel-yaml-dsl-validator
- `camel-zookeeper` ← downstream of org.apache.camel:camel-undertow
</details>
<details><summary>Modules with tests skipped (27)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-catalog`
- `camel-catalog-console`
- `camel-catalog-maven`
- `camel-catalog-suggest`
- `camel-componentdsl`
- `camel-endpointdsl`
- `camel-endpointdsl-support`
- `camel-itest`
- `camel-jbang-core`
- `camel-jbang-it`
- `camel-jbang-main`
- `camel-jbang-plugin-edit`
- `camel-jbang-plugin-generate`
- `camel-jbang-plugin-kubernetes`
- `camel-jbang-plugin-test`
- `camel-kamelet-main`
- `camel-launcher`
- `camel-report-maven-plugin`
- `camel-route-parser`
- `camel-yaml-dsl`
- `camel-yaml-dsl-deserializers`
- `camel-yaml-dsl-maven-plugin`
- `coverage`
- `docs`
- `dummy-component`
</details>
> :information_source: Shadow mode — Scalpel observes but does not affect test execution. [Learn more](https://github.com/maveniverse/scalpel)
</details>
<details><summary>Build reactor — dependencies compiled but only changed modules were tested (3 modules, 31.8s total)</summary>
**Total reactor time:** 31.8s
| Module | Duration | Status |
| --- | --- | --- |
| Camel :: Platform HTTP :: Vert.x | 21.4s | SUCCESS |
| Camel :: HTTP :: Base | 6.9s | SUCCESS |
| Camel :: HTTP :: Common | 3.4s | SUCCESS |
**Top 20 slowest modules:**
- `Camel :: Platform HTTP :: Vert.x` (21.4s)
- `Camel :: HTTP :: Base` (6.9s)
- `Camel :: HTTP :: Common` (3.4s)
</details>
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/36844136410)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24652: camel-http-base, camel-http-common, camel-platform-http-vertx - one fileNameExtWhitelist check [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd merged PR #27194:
URL: https://github.com/apache/camel/pull/27194
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org