shashank created CAMEL-25634:
--------------------------------
Summary: camel-jetty - a text field of a multipart/form-data
request that occurs several times (checkbox group, multi-select) is mapped to a
header with only its first value; the other values are lost
Key: CAMEL-25634
URL: https://issues.apache.org/jira/browse/CAMEL-25634
Project: Camel
Issue Type: Bug
Components: camel-jetty
Reporter: shashank
Assignee: shashank
With a multipart request, {{AttachmentHttpBinding.populateAttachments}} adds
every part, text fields included, as an attachment keyed by the field name.
{{populateRequestParameters}} then maps a parameter that has an attachment of
type {{text/plain}} (or none) to a header with {{request.getParameter(name)}}
(line 131 at main 1de5ec5135f8):
{code:java}
if (am.getAttachment(name) != null) {
DataHandler dh = am.getAttachment(name);
Object value = dh;
if (dh.getContentType() == null ||
dh.getContentType().startsWith("text/plain")) {
// prevent potential injections
value = HttpHelper.sanitizeLog(request.getParameter(name));
}
...appendHeader(headers, name, value);
continue;
}
{code}
{{getParameter}} returns the first value only. A multipart form with
{{tag=integration}}, {{project=Camel}}, {{tag=routing}} gives the header
{{tag}} = {{integration}}; {{routing}} is lost. The parameters that are not
attachments (query parameters, form-urlencoded fields) go through
{{getParameterValues}} a few lines below and keep every value, and
camel-platform-http-vertx and camel-undertow map the same multipart field to a
list of both values (differential test, same request to each consumer). Default
options ({{enableMultipartFilter}} is on).
h3. Reproduction
New {{MultiPartFormRepeatedFieldTest}}: with main it fails with {{expected:
<[integration, routing]> but was: <integration>}}.
camel-jetty with the fix: 404 tests, 0 failures, 23 skipped, 1 error in
{{JettyXsltHttpTemplateTest}} that fails the same way without the change on the
test machine (it fetches a stylesheet from 0.0.0.0).
h3. Proposed fix
Map each value of {{request.getParameterValues(name)}} (sanitized as before)
for a text part; a file part is mapped as before (its {{DataHandler}}).
Behaviour change (4.24 upgrade-guide entry): the header of a repeated multipart
text field is a list of all values, as for a repeated query or form-urlencoded
parameter.
Not changed: several file parts with the same field name still keep one
attachment (attachments are keyed by name), as in the other consumers.
Affected: main 1de5ec5135f8 (tested). camel-4.23.x, camel-4.22.1 and
camel-4.18.4 have the same line; camel-4.14.9 has {{value =
request.getParameter(name);}} (without the sanitizing): read, not run.
Duplicate check (2026-10-14): JIRA text "jetty multipart parameter", "jetty
multipart repeated": none; GitHub pull requests: none.
_Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
