[
https://issues.apache.org/jira/browse/CAMEL-24419?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18106792#comment-18106792
]
Andrea Cosentino commented on CAMEL-24419:
------------------------------------------
Fixed on main via https://github.com/apache/camel/pull/25568 (4.23.0). This
extends the mail header-filtering family (cf. CAMEL-23891/CVE-2026-46584,
backported to 4.14.9/4.18.4) to the MimeMultipart unmarshal path for the
mail.smtp/mail.smtps namespace; a backport to 4.18.x/4.14.x should be evaluated
for consistency with that family.
> camel-mail - MimeMultipartDataFormat unmarshal does not filter the
> mail.smtp/mail.smtps header namespace
> --------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24419
> URL: https://issues.apache.org/jira/browse/CAMEL-24419
> Project: Camel
> Issue Type: Bug
> Components: camel-mail
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> CAMEL-23522 extended MailHeaderFilterStrategy so that the inbound path also
> filters the mail.smtp. and mail.smtps. prefixes, not just Camel*/camel*:
> String[] inFilter = Arrays.copyOf(CAMEL_FILTER_STARTS_WITH,
> CAMEL_FILTER_STARTS_WITH.length + 2);
> inFilter[CAMEL_FILTER_STARTS_WITH.length] = "mail.smtp.";
> inFilter[CAMEL_FILTER_STARTS_WITH.length + 1] = "mail.smtps.";
> setInFilterStartsWith(inFilter);
> MimeMultipartDataFormat, which CAMEL-23891 gave a header filter for the
> Camel* namespace, still holds a plain DefaultHeaderFilterStrategy:
> private final HeaderFilterStrategy headerFilterStrategy = new
> DefaultHeaderFilterStrategy();
> used by copyNonStandardHeaders() (line 283) when headersInline unmarshal
> copies MIME headers onto the exchange. DefaultHeaderFilterStrategy only knows
> Camel*/camel*, so the mail.smtp./mail.smtps. namespace that CAMEL-23522
> deliberately filters on the consumer path is not filtered here.
> Proposal: use MailHeaderFilterStrategy (or a strategy configured with the
> same inbound prefixes) in MimeMultipartDataFormat so both entry points agree
> on the filtered namespace, with a test covering a mail.smtp.* header on
> unmarshal. Backport alongside the CAMEL-23891 backports (4.14.x, 4.18.x).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
