[jira] [Work started] (CAMEL-24427) camel-servlet, camel-jetty - fileNameExtWhitelist is checked against the wrong value in one binding and absent in the other

["Andrea Cosentino (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24427?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Work on CAMEL-24427 started by Andrea Cosentino.
------------------------------------------------
> camel-servlet, camel-jetty - fileNameExtWhitelist is checked against the wrong value in one binding and absent in the other
> ---------------------------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24427
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24427
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-servlet
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.23.0
>
>
> The three HTTP server components that accept multipart uploads disagree about the upload filename check.
> camel-servlet AttachmentHttpBinding.populateAttachments():
> {code:java}
> for (Part part : parts) {
>     String fileName = part.getName();
>     // is the file name accepted
>     boolean accepted = true;
>     if (getFileNameExtWhitelist() != null) {
>         String ext = FileUtil.onlyExt(fileName);
> {code}
> Part.getName() returns the multipart *field* name, not the submitted file name (that is Part.getSubmittedFileName()). A field named for example "file" has no extension, so FileUtil.onlyExt returns null, accepted stays true, and the whitelist never rejects anything.
> camel-jetty jetty12/AttachmentHttpBinding.populateAttachments() has no whitelist check at all, although the option is exposed on the binding.
> camel-platform-http-vertx VertxPlatformHttpConsumer checks the real filename and is the correct reference implementation.
> Proposal: make camel-servlet check part.getSubmittedFileName(), and apply the same check in the camel-jetty binding. Add a test per component asserting a disallowed extension is rejected and an allowed one accepted.
> Separately, the camel-jetty binding also looks up the attachment by the submitted file name while it was stored under the field name, then passes that name to HttpHelper.appendHeader - so an attachment filename ends up as a header name. Worth addressing in the same change.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)