Andrea Cosentino created CAMEL-24433:
----------------------------------------
Summary: camel-mail - attachment file names are neither
path-sanitised on unmarshal nor quoted on marshal
Key: CAMEL-24433
URL: https://issues.apache.org/jira/browse/CAMEL-24433
Project: Camel
Issue Type: Bug
Components: camel-mail
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.23.0
Two ends of the same value.
*Unmarshal.* MimeMultipartDataFormat.getAttachmentKey() takes the file name
from the part and decodes it, with no path sanitisation:
{code:java}
String key = bp.getFileName();
...
return MimeUtility.decodeText(key);
{code}
The key is then used to identify the attachment.
MailBinding.extractAndNormalizeFileName() at least scrubs [\n\r\t]; this path
does neither that nor FileUtil.stripPath, so a sender-chosen name containing
path separators survives intact into the attachment map.
*Marshal.* MailBinding concatenates the attachment file name into an outgoing
header without quoting:
{code:java}
String contentType = contentTypeResolver.resolveContentType(attachmentFilename);
if (contentType != null) {
String value = contentType + "; name=" + attachmentFilename;
messageBodyPart.setHeader("Content-Type", value);
}
{code}
extractAndNormalizeFileName() removes newlines, tabs and carriage returns but
not the characters that matter for a MIME parameter - a semicolon or a double
quote. A relayed attachment named for example {{report.pdf; boundary=--x}}
therefore alters the structure of the header it is written into.
Proposal: apply the same normalisation used by
MailBinding.extractAndNormalizeFileName plus FileUtil.stripPath in
getAttachmentKey, and emit the name as a properly quoted MIME parameter on the
marshal side rather than by concatenation. Tests should cover a name with
separators on unmarshal and a name with a semicolon or quote on marshal.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
