oscerd opened a new pull request, #27194:
URL: https://github.com/apache/camel/pull/27194
## Problem
`fileNameExtWhitelist` had copies of its accept check that had drifted.
`DefaultHttpBinding` (the base
for `camel-servlet` and `camel-jetty`) compares each comma-separated
extension token **exactly**, but
`VertxPlatformHttpConsumer` still used the loose substring form:
```java
if (!fileNameExtWhitelist.equals("*") &&
!fileNameExtWhitelist.contains(ext)) {
accepted = false;
}
```
So with `fileNameExtWhitelist=txt`, a platform-http-vertx upload named
`evil.x`, `evil.t` or `evil.tx`
was accepted, because `"txt".contains("x")`.
## Change
One implementation — `HttpHelper.isFileNameExtWhitelisted(whitelist,
fileName)` in **camel-http-base**,
the only module reachable by both the http-common bindings and the vertx
consumer:
- `DefaultHttpBinding.isFileNameAccepted` delegates to it. Behaviour
unchanged: exact, case-insensitive,
comma-separated token match; `*` accepts everything; a name with no
extension is accepted; the
configured whitelist value is left unmodified.
- `VertxPlatformHttpConsumer` calls it in place of the substring check.
Uploads that only matched as a
substring are now rejected on the vertx consumer too.
This is the behaviour already documented for platform-http in the 4.23
upgrade guide
(*camel-platform-http-starter enforces fileNameExtWhitelist* — "matches
whole comma-separated extension
tokens instead of testing for a substring"); the vertx consumer was still
doing the substring match
despite that note, so no new upgrade-guide entry is added.
### onlyExt stays non-single (deliberate)
The extension is still taken with `FileUtil.onlyExt` (not single mode), so a
multi-dot name is matched on
its **full extension chain**: `archive.tar.gz` needs a whitelist of
`tar.gz`, not `gz`. Keeping this is a
security choice — single mode (last extension only) would let a
double-extension upload such as
`evil.php.jpg` pass a `jpg` whitelist. The stricter behaviour is kept rather
than relaxed.
## Tests
`HttpHelperFileNameExtWhitelistTest` (camel-http-base): null / `*` /
no-extension / exact /
substring-bypass / comma-separated / case-insensitive / multi-dot chain /
double-extension. Revert-to-red
verified (restoring the `contains()` form re-accepts `evil.x`).
`mvn clean install -pl components/camel-http-base` and
`mvn clean test -pl
components/camel-http-common,components/camel-platform-http-vertx` green. No
metadata
change → no catalog/DSL regeneration.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
