This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch camel-4.22.x
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/camel-4.22.x by this push:
new 451d3037ee60 [backport camel-4.22.x] CAMEL-24419: camel-mail - filter
the mail session property namespace on MimeMultipart unmarshal (#25765)
451d3037ee60 is described below
commit 451d3037ee60544cb2158675959416fec5cc5745
Author: Andrea Cosentino <[email protected]>
AuthorDate: Thu Aug 27 06:41:03 2026 +0200
[backport camel-4.22.x] CAMEL-24419: camel-mail - filter the mail session
property namespace on MimeMultipart unmarshal (#25765)
CAMEL-24419: camel-mail - filter the mail session property namespace on
MimeMultipart unmarshal (#25568)
CAMEL-23522 extended MailHeaderFilterStrategy so the inbound path also
filters
the mail.smtp. and mail.smtps. prefixes, not just Camel*/camel*, so an
external
mail message cannot inject JavaMail session properties onto the exchange.
MimeMultipartDataFormat, which CAMEL-23891 gave a header filter for the
Camel*
namespace, still held a plain DefaultHeaderFilterStrategy. That strategy
only
knows Camel*/camel*, so the namespace CAMEL-23522 deliberately filters on
the
consumer path was not filtered by the headersInline unmarshal path.
Switches the data format to MailHeaderFilterStrategy so both entry points
agree
on the filtered namespace. The swap is confined to the inbound direction:
MailHeaderFilterStrategy.initialize() only calls setInFilterStartsWith(),
so the
out filter keeps the DefaultHeaderFilterStrategy default, and the strategy
is
used at exactly one site in the data format (copyNonStandardHeaders, which
calls
applyFilterToExternalHeaders). Marshal behaviour is unchanged.
Adds a test next to the existing CAMEL-23891 one, and a 4.23 upgrade-guide
entry.
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
.../mime/multipart/MimeMultipartDataFormat.java | 4 ++--
.../multipart/MimeMultipartDataFormatTest.java | 22 ++++++++++++++++++++++
2 files changed, 24 insertions(+), 2 deletions(-)
diff --git
a/components/camel-mail/src/main/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormat.java
b/components/camel-mail/src/main/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormat.java
index c1606eae113d..edd685a537b1 100644
---
a/components/camel-mail/src/main/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormat.java
+++
b/components/camel-mail/src/main/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormat.java
@@ -50,10 +50,10 @@ import org.apache.camel.NoTypeConversionAvailableException;
import org.apache.camel.attachment.Attachment;
import org.apache.camel.attachment.AttachmentMessage;
import org.apache.camel.attachment.DefaultAttachment;
+import org.apache.camel.component.mail.MailHeaderFilterStrategy;
import org.apache.camel.spi.HeaderFilterStrategy;
import org.apache.camel.spi.annotations.Dataformat;
import org.apache.camel.support.DefaultDataFormat;
-import org.apache.camel.support.DefaultHeaderFilterStrategy;
import org.apache.camel.support.ExchangeHelper;
import org.apache.camel.support.MessageHelper;
import org.apache.camel.util.IOHelper;
@@ -74,7 +74,7 @@ public class MimeMultipartDataFormat extends
DefaultDataFormat {
private String includeHeaders;
private Pattern includeHeadersPattern;
private boolean binaryContent;
- private final HeaderFilterStrategy headerFilterStrategy = new
DefaultHeaderFilterStrategy();
+ private final HeaderFilterStrategy headerFilterStrategy = new
MailHeaderFilterStrategy();
public String getMultipartSubType() {
return multipartSubType;
diff --git
a/components/camel-mail/src/test/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormatTest.java
b/components/camel-mail/src/test/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormatTest.java
index d88a5d4226f1..d81cebb3fd6c 100644
---
a/components/camel-mail/src/test/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormatTest.java
+++
b/components/camel-mail/src/test/java/org/apache/camel/dataformat/mime/multipart/MimeMultipartDataFormatTest.java
@@ -40,6 +40,7 @@ import org.apache.camel.util.IOHelper;
import org.junit.jupiter.api.Disabled;
import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
import static org.junit.jupiter.api.Assertions.assertArrayEquals;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
@@ -427,6 +428,27 @@ public class MimeMultipartDataFormatTest extends
CamelTestSupport {
assertNull(out.getMessage().getHeader("CAMELBaz"));
}
+ @Test
+ void unmarshalInlineHeadersFiltersMailSessionPropertyHeaders() {
+ // MailHeaderFilterStrategy adds the mail.smtp. / mail.smtps. prefixes
to the inbound filter
+ // (CAMEL-23522) so an external mail message cannot inject JavaMail
session properties. The
+ // headersInline unmarshal path has to filter the same namespace as
the mail consumer does.
+ String mime = "mail.smtp.host: blocked\r\n"
+ + "mail.smtps.auth: blocked\r\n"
+ + "MAIL.SMTP.PORT: blocked\r\n"
+ + "X-Normal: keep-me\r\n"
+ + "Content-Type: text/plain\r\n"
+ + "\r\n"
+ + "Body text";
+ in.setBody(mime);
+ Exchange out = template.send("direct:unmarshalonlyinlineheaders",
exchange);
+ assertThat(out.getMessage()).isNotNull();
+
assertThat(out.getMessage().getHeader("X-Normal")).isEqualTo("keep-me");
+ assertThat(out.getMessage().getHeader("mail.smtp.host")).isNull();
+ assertThat(out.getMessage().getHeader("mail.smtps.auth")).isNull();
+ assertThat(out.getMessage().getHeader("MAIL.SMTP.PORT")).isNull();
+ }
+
@Test
public void unmarshalRelated() throws IOException {
in.setBody(new File("src/test/resources/multipart-related.txt"));
