[
https://issues.apache.org/jira/browse/CAMEL-24427?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-24427 started by Andrea Cosentino.
------------------------------------------------
> camel-servlet, camel-jetty - fileNameExtWhitelist is checked against the
> wrong value in one binding and absent in the other
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24427
> URL: https://issues.apache.org/jira/browse/CAMEL-24427
> Project: Camel
> Issue Type: Bug
> Components: camel-servlet
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> The three HTTP server components that accept multipart uploads disagree about
> the upload filename check.
> camel-servlet AttachmentHttpBinding.populateAttachments():
> {code:java}
> for (Part part : parts) {
> String fileName = part.getName();
> // is the file name accepted
> boolean accepted = true;
> if (getFileNameExtWhitelist() != null) {
> String ext = FileUtil.onlyExt(fileName);
> {code}
> Part.getName() returns the multipart *field* name, not the submitted file
> name (that is Part.getSubmittedFileName()). A field named for example "file"
> has no extension, so FileUtil.onlyExt returns null, accepted stays true, and
> the whitelist never rejects anything.
> camel-jetty jetty12/AttachmentHttpBinding.populateAttachments() has no
> whitelist check at all, although the option is exposed on the binding.
> camel-platform-http-vertx VertxPlatformHttpConsumer checks the real filename
> and is the correct reference implementation.
> Proposal: make camel-servlet check part.getSubmittedFileName(), and apply the
> same check in the camel-jetty binding. Add a test per component asserting a
> disallowed extension is rejected and an allowed one accepted.
> Separately, the camel-jetty binding also looks up the attachment by the
> submitted file name while it was stored under the field name, then passes
> that name to HttpHelper.appendHeader - so an attachment filename ends up as a
> header name. Worth addressing in the same change.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
