oscerd opened a new pull request, #24457: URL: https://github.com/apache/camel/pull/24457
Backport of #24377 to `camel-4.18.x`. CAMEL-23868 makes the `camel-file` path-containment checks path-segment-boundary aware. The local work directory check (`GenericFileHelper.jailToLocalWorkDirectory`, introduced by CAMEL-23765) and the starting-directory check (`GenericFileProducer.jailedCheck`) both used a bare `String.startsWith` prefix test. When the compacted directory has no trailing separator (as `jailToLocalWorkDirectory` produces via `File.getPath`), a sibling directory whose name merely extends the work directory's name (for example `.../localwork` versus `.../localworkEVIL`) passed the check. Both checks now route through a shared, boundary-aware `GenericFileHelper.isWithinDirectory` (`equals(dir) || startsWith(dir + File.separator)`) so they cannot diverge. It tolerates a trailing separator (the producer supplies one) and treats an empty directory as no boundary, preserving existing behaviour. `GenericFileHelperTest` gains coverage for a name-prefixed sibling and for the helper's boundary, trailing-separator and empty-directory cases. Cherry-picked cleanly from `0972796` on `main`; `GenericFileHelperTest` passes (3/3). JIRA: https://issues.apache.org/jira/browse/CAMEL-23868 --- _Claude Code on behalf of Andrea Cosentino_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
