[
https://issues.apache.org/jira/browse/CAMEL-25634?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen updated CAMEL-25634:
--------------------------------
Fix Version/s: 4.24.0
> camel-jetty - a text field of a multipart/form-data request that occurs
> several times (checkbox group, multi-select) is mapped to a header with only
> its first value; the other values are lost
> -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-25634
> URL: https://issues.apache.org/jira/browse/CAMEL-25634
> Project: Camel
> Issue Type: Bug
> Components: camel-jetty
> Reporter: shashank
> Assignee: shashank
> Priority: Major
> Fix For: 4.24.0
>
>
> With a multipart request, {{AttachmentHttpBinding.populateAttachments}} adds
> every part, text fields included, as an attachment keyed by the field name.
> {{populateRequestParameters}} then maps a parameter that has an attachment of
> type {{text/plain}} (or none) to a header with {{request.getParameter(name)}}
> (line 131 at main 1de5ec5135f8):
> {code:java}
> if (am.getAttachment(name) != null) {
> DataHandler dh = am.getAttachment(name);
> Object value = dh;
> if (dh.getContentType() == null ||
> dh.getContentType().startsWith("text/plain")) {
> // prevent potential injections
> value = HttpHelper.sanitizeLog(request.getParameter(name));
> }
> ...appendHeader(headers, name, value);
> continue;
> }
> {code}
> {{getParameter}} returns the first value only. A multipart form with
> {{tag=integration}}, {{project=Camel}}, {{tag=routing}} gives the header
> {{tag}} = {{integration}}; {{routing}} is lost. The parameters that are not
> attachments (query parameters, form-urlencoded fields) go through
> {{getParameterValues}} a few lines below and keep every value, and
> camel-platform-http-vertx and camel-undertow map the same multipart field to
> a list of both values (differential test, same request to each consumer).
> Default options ({{enableMultipartFilter}} is on).
> h3. Reproduction
> New {{MultiPartFormRepeatedFieldTest}}: with main it fails with {{expected:
> <[integration, routing]> but was: <integration>}}.
> camel-jetty with the fix: 404 tests, 0 failures, 23 skipped, 1 error in
> {{JettyXsltHttpTemplateTest}} that fails the same way without the change on
> the test machine (it fetches a stylesheet from 0.0.0.0).
> h3. Proposed fix
> Map each value of {{request.getParameterValues(name)}} (sanitized as before)
> for a text part; a file part is mapped as before (its {{DataHandler}}).
> Behaviour change (4.24 upgrade-guide entry): the header of a repeated
> multipart text field is a list of all values, as for a repeated query or
> form-urlencoded parameter.
> Not changed: several file parts with the same field name still keep one
> attachment (attachments are keyed by name), as in the other consumers.
> Affected: main 1de5ec5135f8 (tested). camel-4.23.x, camel-4.22.1 and
> camel-4.18.4 have the same line; camel-4.14.9 has {{value =
> request.getParameter(name);}} (without the sanitizing): read, not run.
> Duplicate check (2026-10-14): JIRA text "jetty multipart parameter", "jetty
> multipart repeated": none; GitHub pull requests: none.
> _Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
