oscerd opened a new pull request, #27267: URL: https://github.com/apache/camel/pull/27267
Backport of #26872 (CAMEL-24650) and #27194 (CAMEL-24652) to `camel-4.22.x`. On this branch `fileNameExtWhitelist` was still matched as a substring in two places, so for example a whitelist of `txt` accepted an upload named `evil.x`: - `VertxPlatformHttpConsumer` (`camel-platform-http-vertx`), and - `DefaultHttpBinding.populateAttachments` (`camel-http-common`) for uploads that arrive as request attributes, which also replaced the configured `fileNameExtWhitelist` with its lower-cased value. The servlet and jetty attachment bindings already compare exactly since the CAMEL-24427 backport. With this backport all of them share one check, `HttpHelper.isFileNameExtWhitelisted` in `camel-http-base`: each comma-separated entry is compared exactly and case-insensitively, `*` accepts everything, a file name without an extension is accepted, and the configured value is not modified. ## How it was ported - `git cherry-pick -x` of `0099984f8365` (#26872) and `efd80d5ee2c7` (#27194). The code and test hunks are identical to main. The only conflict was the main-only `camel-4x-upgrade-guide-4_23.adoc`, which is dropped; the matching 4.22.2 / 4.18.5 upgrade-guide entries go to main in __DOCSYNC__. - One adaptation commit: `VertxPlatformHttpConsumer` gains `import org.apache.camel.http.base.HttpHelper;` and the module declares `camel-http-base` directly. On main both already existed from an unrelated earlier change, so the cherry-pick did not carry them. `camel-http-base` was already on this branch's classpath through `camel-platform-http`, so no new artifact is added. Because of that adaptation commit, and because #26872's approvals were all AI-generated, this needs a human review rather than the straight-backport exception. ## Testing Full reactor `mvn clean install -DskipTests` green on `camel-4.22.x`, with no regenerated-file drift. Module tests all pass: camel-http-base 33, camel-http-common 36, camel-servlet 102 (2 skipped), camel-jetty multipart and whitelist tests 10, camel-platform-http-vertx 129 (1 skipped) — including `HttpHelperFileNameExtWhitelistTest`, `DefaultHttpBindingTest`, `MultipartUploadFileNameExtWhitelistTest` and `MultiPartFormFileNameExtWhitelistTest`. --- _Claude Code on behalf of @oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
