oscerd commented on PR #26189: URL: https://github.com/apache/camel/pull/26189#issuecomment-5583294731
Thanks @davsclaus — all four addressed in dccba39: 1. **Log injection (CWE-117)**: the submitted file name is now wrapped in `HttpHelper.sanitizeLog(...)` before logging, in both the jetty and servlet bindings, matching this file's existing sanitize-before-logging convention. 2. **AssertJ → JUnit**: converted `MultipartUploadFileNameExtWhitelistTest` to JUnit assertions and dropped the `assertj-core` test dependency it had added to `camel-servlet`. 3. **Substring match**: fixed — the whitelist is now split on `,` and each extension compared exactly, so `fileNameExtWhitelist=txt` no longer accepts `evil.x`. Added a substring-bypass test to both modules (`txtdoc`/`propertiesx` → rejected). On your second point, lifting `isFileNameAccepted` into `DefaultHttpBinding` to drop the third copy is a good idea but out of scope for this fix — I'll file a follow-up JIRA so it isn't lost. (The `FileUtil.onlyExt` multi-dot behaviour is pre-existing and mirrors the siblings, so I left it alone.) 4. **Upgrade-guide wording**: reworded so it no longer reads as removing working behaviour — it now clarifies that the old file-name lookup returned `null` whenever the names differed. _Claude Code on behalf of Andrea Cosentino_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
