This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch camel-4.18.x
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/camel-4.18.x by this push:
new e25a496381c1 CAMEL-24419: camel-mail - filter the mail session
property namespace on MimeMultipart unmarshal (#25568) (#25766)
e25a496381c1 is described below
commit e25a496381c1330aea16f26136ce02bb818ccccb
Author: Andrea Cosentino <[email protected]>
AuthorDate: Thu Aug 27 06:39:32 2026 +0200
CAMEL-24419: camel-mail - filter the mail session property namespace on
MimeMultipart unmarshal (#25568) (#25766)
CAMEL-23522 extended MailHeaderFilterStrategy so the inbound path also
filters
the mail.smtp. and mail.smtps. prefixes, not just Camel*/camel*, so an
external
mail message cannot inject JavaMail session properties onto the exchange.
MimeMultipartDataFormat, which CAMEL-23891 gave a header filter for the
Camel*
namespace, still held a plain DefaultHeaderFilterStrategy. That strategy
only
knows Camel*/camel*, so the namespace CAMEL-23522 deliberately filters on
the
consumer path was not filtered by the headersInline unmarshal path.
Switches the data format to MailHeaderFilterStrategy so both entry points
agree
on the filtered namespace. The swap is confined to the inbound direction:
MailHeaderFilterStrategy.initialize() only calls setInFilterStartsWith(),
so the
out filter keeps the DefaultHeaderFilterStrategy default, and the strategy
is
used at exactly one site in the data format (copyNonStandardHeaders, which
calls
applyFilterToExternalHeaders). Marshal behaviour is unchanged.
Adds a test next to the existing CAMEL-23891 one, and a 4.23 upgrade-guide
entry.
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
.../mime/multipart/MimeMultipartDataFormat.java | 13 ++-----------
.../multipart/MimeMultipartDataFormatTest.java | 22 ++++++++++++++++++++++
2 files changed, 24 insertions(+), 11 deletions(-)
diff --git
a/components/camel-mail/src/main/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormat.java
b/components/camel-mail/src/main/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormat.java
index 29e0a84ff727..c8676d671744 100644
---
a/components/camel-mail/src/main/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormat.java
+++
b/components/camel-mail/src/main/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormat.java
@@ -50,10 +50,10 @@ import org.apache.camel.NoTypeConversionAvailableException;
import org.apache.camel.attachment.Attachment;
import org.apache.camel.attachment.AttachmentMessage;
import org.apache.camel.attachment.DefaultAttachment;
+import org.apache.camel.component.mail.MailHeaderFilterStrategy;
import org.apache.camel.spi.HeaderFilterStrategy;
import org.apache.camel.spi.annotations.Dataformat;
import org.apache.camel.support.DefaultDataFormat;
-import org.apache.camel.support.DefaultHeaderFilterStrategy;
import org.apache.camel.support.ExchangeHelper;
import org.apache.camel.support.MessageHelper;
import org.apache.camel.util.IOHelper;
@@ -74,7 +74,7 @@ public class MimeMultipartDataFormat extends
DefaultDataFormat {
private String includeHeaders;
private Pattern includeHeadersPattern;
private boolean binaryContent;
- private final HeaderFilterStrategy headerFilterStrategy =
createInboundHeaderFilterStrategy();
+ private final HeaderFilterStrategy headerFilterStrategy = new
MailHeaderFilterStrategy();
public String getMultipartSubType() {
return multipartSubType;
@@ -124,15 +124,6 @@ public class MimeMultipartDataFormat extends
DefaultDataFormat {
this.binaryContent = binaryContent;
}
- private static HeaderFilterStrategy createInboundHeaderFilterStrategy() {
- DefaultHeaderFilterStrategy strategy = new
DefaultHeaderFilterStrategy();
- // camel-4.18 DefaultHeaderFilterStrategy does not enable the Camel*
in-filter by default (that
- // default was introduced on a later branch), so configure it
explicitly to filter the Camel*
- // namespace on the inbound path, matching the mail consumer's
HeaderFilterStrategy.
-
strategy.setInFilterStartsWith(DefaultHeaderFilterStrategy.CAMEL_FILTER_STARTS_WITH);
- return strategy;
- }
-
@Override
public void marshal(Exchange exchange, Object graph, OutputStream stream)
throws NoTypeConversionAvailableException, MessagingException,
IOException {
diff --git
a/components/camel-mail/src/test/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormatTest.java
b/components/camel-mail/src/test/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormatTest.java
index 56ae3d59f2d8..11ddfdc9a58a 100644
---
a/components/camel-mail/src/test/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormatTest.java
+++
b/components/camel-mail/src/test/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormatTest.java
@@ -40,6 +40,7 @@ import org.apache.camel.util.IOHelper;
import org.junit.jupiter.api.Disabled;
import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
import static org.junit.jupiter.api.Assertions.assertArrayEquals;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
@@ -427,6 +428,27 @@ public class MimeMultipartDataFormatTest extends
CamelTestSupport {
assertNull(out.getMessage().getHeader("CAMELBaz"));
}
+ @Test
+ void unmarshalInlineHeadersFiltersMailSessionPropertyHeaders() {
+ // MailHeaderFilterStrategy adds the mail.smtp. / mail.smtps. prefixes
to the inbound filter
+ // (CAMEL-23522) so an external mail message cannot inject JavaMail
session properties. The
+ // headersInline unmarshal path has to filter the same namespace as
the mail consumer does.
+ String mime = "mail.smtp.host: blocked\r\n"
+ + "mail.smtps.auth: blocked\r\n"
+ + "MAIL.SMTP.PORT: blocked\r\n"
+ + "X-Normal: keep-me\r\n"
+ + "Content-Type: text/plain\r\n"
+ + "\r\n"
+ + "Body text";
+ in.setBody(mime);
+ Exchange out = template.send("direct:unmarshalonlyinlineheaders",
exchange);
+ assertThat(out.getMessage()).isNotNull();
+
assertThat(out.getMessage().getHeader("X-Normal")).isEqualTo("keep-me");
+ assertThat(out.getMessage().getHeader("mail.smtp.host")).isNull();
+ assertThat(out.getMessage().getHeader("mail.smtps.auth")).isNull();
+ assertThat(out.getMessage().getHeader("MAIL.SMTP.PORT")).isNull();
+ }
+
@Test
public void unmarshalRelated() throws IOException {
in.setBody(new File("src/test/resources/multipart-related.txt"));
