[
https://issues.apache.org/jira/browse/CAMEL-24433?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-24433 started by Andrea Cosentino.
------------------------------------------------
> camel-mail - attachment file names are neither path-sanitised on unmarshal
> nor quoted on marshal
> ------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24433
> URL: https://issues.apache.org/jira/browse/CAMEL-24433
> Project: Camel
> Issue Type: Bug
> Components: camel-mail
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> Two ends of the same value.
> *Unmarshal.* MimeMultipartDataFormat.getAttachmentKey() takes the file name
> from the part and decodes it, with no path sanitisation:
> {code:java}
> String key = bp.getFileName();
> ...
> return MimeUtility.decodeText(key);
> {code}
> The key is then used to identify the attachment.
> MailBinding.extractAndNormalizeFileName() at least scrubs [\n\r\t]; this path
> does neither that nor FileUtil.stripPath, so a sender-chosen name containing
> path separators survives intact into the attachment map.
> *Marshal.* MailBinding concatenates the attachment file name into an outgoing
> header without quoting:
> {code:java}
> String contentType =
> contentTypeResolver.resolveContentType(attachmentFilename);
> if (contentType != null) {
> String value = contentType + "; name=" + attachmentFilename;
> messageBodyPart.setHeader("Content-Type", value);
> }
> {code}
> extractAndNormalizeFileName() removes newlines, tabs and carriage returns but
> not the characters that matter for a MIME parameter - a semicolon or a double
> quote. A relayed attachment named for example {{report.pdf; boundary=--x}}
> therefore alters the structure of the header it is written into.
> Proposal: apply the same normalisation used by
> MailBinding.extractAndNormalizeFileName plus FileUtil.stripPath in
> getAttachmentKey, and emit the name as a properly quoted MIME parameter on
> the marshal side rather than by concatenation. Tests should cover a name with
> separators on unmarshal and a name with a semicolon or quote on marshal.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
