resteasy: exclude filename-bearing parts from the body-map cap

A part declaring Content-Type: text/plain but also carrying a
filename attribute was still treated as a form field by
collectBodyMap(), so an attacker could pad the body-map cap with
disposable text/plain file parts and push a genuine field out of
server.request.body. Exclude any part with a filename attribute
(present, even empty) regardless of its declared media type, matching
the file/field distinction collectFilesContent() already uses.

Addresses a P1 finding from the Codex review on PR #12085.

Author: jandro996

dd-java-agent/instrumentation/resteasy/resteasy-appsec-3.0/src/main/java/datadog/trace/instrumentation/resteasy/MultipartHelper.java

@@ -42,20 +42,24 @@ private MultipartHelper() {}
   /**
    * Builds the {@code server.request.body} map out of the multipart parts.
    *
-   * <p>Only text/plain parts are collected, matching the Jersey reference: file parts are reported
-   * separately via {@link #collectFilenames} / {@link #collectFilesContent} and must not also
-   * consume the body-map budget. The number of collected values is capped by {@link
-   * #MAX_FILES_TO_INSPECT}. The cap counts the total accumulated values across all field names, not
-   * the distinct keys: {@code getFormDataMap()} already groups parts by field name, so a per-key
-   * cap would be trivially bypassed by repeating the same field name on every part.
+   * <p>Only text/plain parts with no {@code filename} attribute are collected, matching the intent
+   * of the Jersey reference: file parts (including a file declared with a {@code text/plain}
+   * content-type) are reported separately via {@link #collectFilenames} / {@link
+   * #collectFilesContent} and must not also consume the body-map budget, or a request could pad out
+   * the cap with disposable text-file parts and push a real form field out of the map. The number
+   * of collected values is capped by {@link #MAX_FILES_TO_INSPECT}. The cap counts the total
+   * accumulated values across all field names, not the distinct keys: {@code getFormDataMap()}
+   * already groups parts by field name, so a per-key cap would be trivially bypassed by repeating
+   * the same field name on every part.
    */
   public static Map<String, List<String>> collectBodyMap(MultipartFormDataInput ret) {
     Map<String, List<String>> bodyMap = new HashMap<>();
     int total = 0;
     for (Map.Entry<String, List<InputPart>> e : ret.getFormDataMap().entrySet()) {
       for (InputPart inputPart : e.getValue()) {
-        String contentType = contentTypeOf(inputPart);
-        if (!isTextPlain(contentType)) {
+        Map<String, List<String>> headers = headersOf(inputPart);
+        String contentType = contentTypeOf(headers);
+        if (!isTextPlain(contentType) || hasFilename(headers)) {
           continue;
         }
         if (total >= MAX_FILES_TO_INSPECT) {
@@ -91,26 +95,47 @@ private static String contentTypeWithDefaultUtf8(String contentType) {
         : contentType;
   }
 
-  private static String contentTypeOf(InputPart inputPart) {
+  // Used by collectBodyMap only: collectFilenames/collectFilesContent do their own reflective
+  // getHeaders() call and are intentionally left untouched (out of scope, already correct).
+  private static Map<String, List<String>> headersOf(InputPart inputPart) {
     if (GET_HEADERS == null) {
       return null;
     }
     try {
       @SuppressWarnings("unchecked")
       Map<String, List<String>> headers = (Map<String, List<String>>) GET_HEADERS.invoke(inputPart);
-      if (headers == null) {
-        return null;
-      }
-      List<String> ctHeaders = getHeaderCaseInsensitive(headers, "Content-Type");
-      return (ctHeaders != null && !ctHeaders.isEmpty()) ? ctHeaders.get(0) : null;
+      return headers;
     } catch (Exception e) {
       // Reflective getHeaders() call failed (unexpected InputPart implementation): fall back to
-      // resolving no content-type rather than aborting the whole request's body-map collection.
+      // resolving no headers rather than aborting the whole request's body-map collection.
       log.debug("Failed to read multipart part headers via reflection", e);
       return null;
     }
   }
 
+  private static String contentTypeOf(Map<String, List<String>> headers) {
+    if (headers == null) {
+      return null;
+    }
+    List<String> ctHeaders = getHeaderCaseInsensitive(headers, "Content-Type");
+    return (ctHeaders != null && !ctHeaders.isEmpty()) ? ctHeaders.get(0) : null;
+  }
+
+  // A part with a filename attribute (present, even if empty) is a file upload, not a form field,
+  // regardless of its declared content-type: a file can be declared text/plain and would otherwise
+  // pass isTextPlain() and consume the body-map budget meant for genuine form fields. Matches the
+  // same rawFilename-presence check collectFilesContent() already uses to decide "is this a file".
+  private static boolean hasFilename(Map<String, List<String>> headers) {
+    if (headers == null) {
+      return false;
+    }
+    List<String> cdHeaders = getHeaderCaseInsensitive(headers, "Content-Disposition");
+    if (cdHeaders == null || cdHeaders.isEmpty()) {
+      return false;
+    }
+    return rawFilenameFromContentDisposition(cdHeaders.get(0)) != null;
+  }
+
   public static List<String> collectFilenames(MultipartFormDataInput ret) {
     List<String> filenames = new ArrayList<>();
     if (GET_HEADERS == null) {

dd-java-agent/instrumentation/resteasy/resteasy-appsec-3.0/src/test/groovy/MultipartHelperTest.groovy

@@ -361,12 +361,30 @@ class MultipartHelperTest extends Specification {
     0 * file.getBody(_, _)
   }
 
+  def "collectBodyMap excludes a text/plain part that also declares a filename"() {
+    given: "a file uploaded with an explicit text/plain content-type, plus a real text field"
+    def textFile = Mock(InputPart)
+    textFile.getHeaders() >> headers('form-data; name="upload"; filename="notes.txt"', 'text/plain')
+    def text = Mock(InputPart)
+    text.getHeaders() >> headers('form-data; name="q"')
+    text.getBody(_, _) >> new ByteArrayInputStream('<script>'.bytes)
+    def ret = Mock(MultipartFormDataInput)
+    ret.getFormDataMap() >> ['upload': [textFile], 'q': [text]]
+
+    when:
+    def result = MultipartHelper.collectBodyMap(ret)
+
+    then: "the text/plain file part never reaches getBody() and does not consume the body-map cap"
+    result == ['q': ['<script>']]
+    0 * textFile.getBody(_, _)
+  }
+
   def "collectBodyMap does not let dummy file parts exhaust the cap before a real text field"() {
-    given: "MAX_FILES_TO_INSPECT dummy file parts followed by one real text field"
+    given: "MAX_FILES_TO_INSPECT dummy text/plain file parts followed by one real text field"
     def entries = [:]
     (1..MultipartHelper.MAX_FILES_TO_INSPECT).each { i ->
       def p = Mock(InputPart)
-      p.getHeaders() >> headers("form-data; name=\"file${i}\"; filename=\"f${i}.bin\"", 'application/octet-stream')
+      p.getHeaders() >> headers("form-data; name=\"file${i}\"; filename=\"f${i}.txt\"", 'text/plain')
       entries["file${i}".toString()] = [p]
     }
     def q = Mock(InputPart)