This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 0a6098d8e964 CAMEL-23765: sync localWorkDirectory containment note to
the 4.18/4.14 upgrade guides on main (#24221)
0a6098d8e964 is described below
commit 0a6098d8e96484e7a88acb12a002bb0ec3c3d274
Author: Andrea Cosentino <[email protected]>
AuthorDate: Wed Jun 24 15:20:29 2026 +0200
CAMEL-23765: sync localWorkDirectory containment note to the 4.18/4.14
upgrade guides on main (#24221)
The localWorkDirectory path-traversal containment fix is backported to
camel-4.18.x
(#24219) and camel-4.14.x (#24220). Per the backport upgrade-guide policy
the
version-specific guide entries live on main; add a note for the new
behaviour to the
4_18 and 4_14 guides (the 4_14 entry omits camel-mina-sftp, which does not
exist on
that branch).
Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>
---
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_14.adoc | 8 ++++++++
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 8 ++++++++
2 files changed, 16 insertions(+)
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_14.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_14.adoc
index 238d0ee1a3c7..b4f34880e791 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_14.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_14.adoc
@@ -55,6 +55,14 @@ longer be accepted when the configured JWK set is missing or
empty, since its si
verified in that case. Deployments with a correctly resolved JWK set are
unaffected; this aligns the
legacy `UserProfile` path with the `JwtTokenValidator` SPI path.
+=== camel-ftp, camel-sftp, camel-azure-files, camel-smb
+
+When `localWorkDirectory` is used, the remote-file consumers now ensure the
downloaded local work file
+stays within the configured work directory, so a remote file name containing
`../` sequences can no longer
+resolve to a path outside it. The containment check honours the existing
`jailStartingDirectory` option
+(default `true`); set `jailStartingDirectory=false` to disable it. A remote
file that resolves outside the
+local work directory is rejected with a `GenericFileOperationFailedException`.
+
=== camel-spring-ws - potential breaking change
The `spring-ws` consumer now applies a `HeaderFilterStrategy` to the SOAP
headers it maps onto the
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index b2c88fbabf99..727f5842b391 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -55,6 +55,14 @@ longer be accepted when the configured JWK set is missing or
empty, since its si
verified in that case. Deployments with a correctly resolved JWK set are
unaffected; this aligns the
legacy `UserProfile` path with the `JwtTokenValidator` SPI path.
+=== camel-ftp, camel-sftp, camel-mina-sftp, camel-azure-files, camel-smb
+
+When `localWorkDirectory` is used, the remote-file consumers now ensure the
downloaded local work file
+stays within the configured work directory, so a remote file name containing
`../` sequences can no longer
+resolve to a path outside it. The containment check honours the existing
`jailStartingDirectory` option
+(default `true`); set `jailStartingDirectory=false` to disable it. A remote
file that resolves outside the
+local work directory is rejected with a `GenericFileOperationFailedException`.
+
=== camel-spring-ws - potential breaking change
The `spring-ws` consumer now applies a `HeaderFilterStrategy` to the SOAP
headers it maps onto the
