oscerd opened a new pull request, #24581: URL: https://github.com/apache/camel/pull/24581
Backport of #24542 to `camel-4.18.x`. ## What When `fileDir` is configured, the Azure Storage Blob and DataLake consumers build the local download target from the remote object name via `new File(fileDir, name)` with no containment check, so a name containing `../` segments could resolve to a location outside `fileDir`. This aligns them with the containment already performed by the file-based consumers. ## How `camel-azure-common` does not exist on this branch (it was introduced in 4.19), so the shared `AzureFileNameHelper` from the main-branch fix cannot be reused here. Instead, the same guard is added as a small `private static` method in each of `BlobOperations` and `DataLakeFileOperations`: it resolves the name against `fileDir`, normalizes lexically, and verifies the result stays within `fileDir` on path-segment boundaries (`java.nio.file`), throwing `IllegalArgumentException` otherwise. ## Tests - Wiring test in `BlobOperationsTest` / `DataLakeFileOperationTest` asserting a `../`-bearing object name is rejected at the download call site. ## Notes - Upgrade-guide note added to `camel-4x-upgrade-guide-4_18.adoc`. The matching entry will also be synced to `main`'s copy of that guide per the backport upgrade-guide policy. --- _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
