Andrea Cosentino created CAMEL-24427:
----------------------------------------
Summary: camel-servlet, camel-jetty - fileNameExtWhitelist is
checked against the wrong value in one binding and absent in the other
Key: CAMEL-24427
URL: https://issues.apache.org/jira/browse/CAMEL-24427
Project: Camel
Issue Type: Bug
Components: camel-servlet
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.23.0
The three HTTP server components that accept multipart uploads disagree about
the upload filename check.
camel-servlet AttachmentHttpBinding.populateAttachments():
{code:java}
for (Part part : parts) {
String fileName = part.getName();
// is the file name accepted
boolean accepted = true;
if (getFileNameExtWhitelist() != null) {
String ext = FileUtil.onlyExt(fileName);
{code}
Part.getName() returns the multipart *field* name, not the submitted file name
(that is Part.getSubmittedFileName()). A field named for example "file" has no
extension, so FileUtil.onlyExt returns null, accepted stays true, and the
whitelist never rejects anything.
camel-jetty jetty12/AttachmentHttpBinding.populateAttachments() has no
whitelist check at all, although the option is exposed on the binding.
camel-platform-http-vertx VertxPlatformHttpConsumer checks the real filename
and is the correct reference implementation.
Proposal: make camel-servlet check part.getSubmittedFileName(), and apply the
same check in the camel-jetty binding. Add a test per component asserting a
disallowed extension is rejected and an allowed one accepted.
Separately, the camel-jetty binding also looks up the attachment by the
submitted file name while it was stored under the field name, then passes that
name to HttpHelper.appendHeader - so an attachment filename ends up as a header
name. Worth addressing in the same change.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
