[
https://issues.apache.org/jira/browse/CAMEL-24650?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18121892#comment-18121892
]
Andrea Cosentino commented on CAMEL-24650:
------------------------------------------
Backport PRs: https://github.com/apache/camel/pull/27267 (camel-4.22.x) and
https://github.com/apache/camel/pull/27268 (camel-4.18.x), together covering
CAMEL-24650 and CAMEL-24652; upgrade-guide entries for 4.22.2 and 4.18.5 in
https://github.com/apache/camel/pull/27269. fixVersions to be added once they
merge.
_Claude Code on behalf of oscerd_
> camel-http-common: lift the multipart fileNameExtWhitelist check into
> DefaultHttpBinding
> ----------------------------------------------------------------------------------------
>
> Key: CAMEL-24650
> URL: https://issues.apache.org/jira/browse/CAMEL-24650
> Project: Camel
> Issue Type: Improvement
> Components: camel-http-common
> Reporter: Andrea Cosentino
> Priority: Minor
> Fix For: 4.23.0
>
>
> Follow-up from the review of CAMEL-24427. The fileNameExtWhitelist
> enforcement for multipart uploads is currently implemented in three places
> that must be kept in sync: camel-servlet's AttachmentHttpBinding (inline),
> camel-jetty's AttachmentHttpBinding (isFileNameAccepted), and
> VertxPlatformHttpConsumer. Both servlet and jetty bindings extend
> DefaultHttpBinding, so the check could be lifted into DefaultHttpBinding (in
> camel-http-common) and reused, leaving a single implementation and preventing
> future drift.
> While there, consider the FileUtil.onlyExt multi-dot behaviour: it returns
> everything after the first dot (non-single mode), so archive.tar.gz yields
> tar.gz and a whitelist of gz rejects it - decide whether last-extension
> matching (onlyExt(name, true)) is more appropriate. Pre-existing behaviour
> mirrored across the three copies; out of scope for CAMEL-24427.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
