resteasy: recognize filename* in collectFilesContent too

hasFilename() now excludes filename*-only parts from the body map, but
collectFilesContent() still gated on rawFilenameFromContentDisposition(),
which is filename*-blind — such a part reached neither AppSec callback.
Switch the gate to hasFilenameParam() so content inspection still covers
it (Codex P1 follow-up on PR #12085).

Author: jandro996

dd-java-agent/instrumentation/resteasy/resteasy-appsec-3.0/src/main/java/datadog/trace/instrumentation/resteasy/MultipartHelper.java

@@ -125,8 +125,9 @@ private static String contentTypeOf(Map<String, List<String>> headers) {
   // regardless of its declared content-type: a file can be declared text/plain and would otherwise
   // pass isTextPlain() and consume the body-map budget meant for genuine form fields. Uses
   // hasFilenameParam() rather than rawFilenameFromContentDisposition(), which deliberately ignores
-  // the RFC 5987 "filename*" form: a part carrying only "filename*" must still be excluded here,
-  // even though its filename value isn't decoded/reported elsewhere in this file.
+  // the RFC 5987 "filename*" form: a part carrying only "filename*" must still be excluded here.
+  // collectFilesContent() uses the same hasFilenameParam() gate, so such a part is still inspected
+  // there even though this file never decodes its filename* value.
   private static boolean hasFilename(Map<String, List<String>> headers) {
     if (headers == null) {
       return false;
@@ -228,9 +229,9 @@ public static List<String> collectFilesContent(MultipartFormDataInput ret) {
         if (cdHeaders == null || cdHeaders.isEmpty()) {
           continue;
         }
-        // rawFilenameFromContentDisposition returns null if filename attr absent,
-        // otherwise returns the value (possibly empty) — both cases warrant content inspection
-        if (rawFilenameFromContentDisposition(cdHeaders.get(0)) == null) {
+        // hasFilenameParam recognizes both filename and filename* (see its javadoc): a part with
+        // neither is a plain form field, already covered by collectBodyMap, and skipped here.
+        if (!hasFilenameParam(cdHeaders.get(0))) {
           continue;
         }
         List<String> ctHeaders = getHeaderCaseInsensitive(headers, "Content-Type");

dd-java-agent/instrumentation/resteasy/resteasy-appsec-3.0/src/test/groovy/MultipartHelperTest.groovy

@@ -448,6 +448,21 @@ class MultipartHelperTest extends Specification {
     result == ['anonymous']
   }
 
+  def "collectFilesContent includes part with only an RFC 5987 filename* (security fix)"() {
+    given: "a file declaring filename* only, no plain filename"
+    def part = Mock(InputPart)
+    part.getHeaders() >> headers('form-data; name="upload"; filename*=UTF-8\'\'notes.txt', 'text/plain')
+    part.getBody(_, _) >> new ByteArrayInputStream('<script>'.bytes)
+    def ret = Mock(MultipartFormDataInput)
+    ret.getFormDataMap() >> ['upload': [part]]
+
+    when:
+    def result = MultipartHelper.collectFilesContent(ret)
+
+    then: "content is still inspected here even though collectBodyMap now excludes this part"
+    result == ['<script>']
+  }
+
   def "collectFilesContent skips part without filename attribute"() {
     given:
     def part = Mock(InputPart)