gnodet commented on code in PR #26189:
URL: https://github.com/apache/camel/pull/26189#discussion_r3956671774
##########
components/camel-servlet/src/main/java/org/apache/camel/component/servlet/AttachmentHttpBinding.java:
##########
@@ -54,7 +54,9 @@ protected void populateAttachments(HttpServletRequest
request, Message message)
try {
Collection<Part> parts = request.getParts();
for (Part part : parts) {
- String fileName = part.getName();
+ // the whitelist accepts file name extensions, so it must be
checked against the submitted file
+ // name and not against Part.getName(), which is the multipart
field name
+ String fileName = part.getSubmittedFileName();
Review Comment:
⚠️ **Log injection (CWE-117) — same issue as jetty, different file.**
`fileName` is now `part.getSubmittedFileName()`, which is fully
client-controlled. The existing `LOG.debug` call at lines 84–86 passes it
directly to the logger without sanitization:
```java
LOG.debug(
"Cannot add file as attachment: {} because the file is not accepted
according to fileNameExtWhitelist: {}",
fileName, getFileNameExtWhitelist());
```
This file does not currently import `HttpHelper`, but `camel-http-common` is
already on the module's compile classpath (`DefaultHttpBinding` extends it).
The fix mirrors the suggestion on the jetty side:
```suggestion
String fileName = part.getSubmittedFileName();
```
And in the LOG.debug block at lines 84–86, wrap `fileName`:
```java
LOG.debug(
"Cannot add file as attachment: {} because the file is not accepted
according to fileNameExtWhitelist: {}",
HttpHelper.sanitizeLog(fileName), getFileNameExtWhitelist());
```
With the required import:
```java
import org.apache.camel.http.common.HttpHelper;
```
(The LOG.debug block itself is not in the diff so a suggestion block cannot
target it directly — the fix must be applied manually.)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
