This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 09d246d411cb CAMEL-24279: sync camel-google-storage download
containment note to the 4.18/4.14 upgrade guides on main (#25182)
09d246d411cb is described below
commit 09d246d411cb2ba6bb1d7832e0c232056d955d34
Author: Andrea Cosentino <[email protected]>
AuthorDate: Tue Jul 28 14:12:47 2026 +0200
CAMEL-24279: sync camel-google-storage download containment note to the
4.18/4.14 upgrade guides on main (#25182)
The fix is backported to camel-4.18.x (4.18.4) and camel-4.14.x (4.14.9),
where the
note is added to the branch's own upgrade guide. Per the backport
upgrade-guide policy
the version-specific guides on main are the canonical history across all
releases, so
the matching entries are added here too.
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_14.adoc | 14 ++++++++++++++
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 14 ++++++++++++++
2 files changed, 28 insertions(+)
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_14.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_14.adoc
index b2eebbb02085..b79f499a92d6 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_14.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_14.adoc
@@ -1615,3 +1615,17 @@ by the file-based consumers.
Ordinary object names are unaffected. A name that resolves outside `fileDir`
is now rejected with an
`IllegalArgumentException`.
+
+=== camel-google-storage - downloads are confined to the configured directory
+
+When the consumer is configured with `downloadFileName` pointing at a
directory, the
+remote object name is appended to that directory to build the local file to
write.
+The resolved path is now verified to stay within the configured directory, and
an
+`IllegalArgumentException` is thrown if it does not.
+
+Object names are still allowed to contain `/` and are mapped to
sub-directories of the
+download directory as before, so nested object names keep working unchanged.
Only names
+that resolve outside the configured directory are rejected.
+
+If `downloadFileName` is configured with an expression (i.e. it contains `$`),
the local
+path is built by that expression as before and is not subject to this check.
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index 57772d7be1fa..34e908bd9831 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -1934,3 +1934,17 @@ by the file-based consumers.
Ordinary object names are unaffected. A name that resolves outside `fileDir`
is now rejected with an
`IllegalArgumentException`.
+
+=== camel-google-storage - downloads are confined to the configured directory
+
+When the consumer is configured with `downloadFileName` pointing at a
directory, the
+remote object name is appended to that directory to build the local file to
write.
+The resolved path is now verified to stay within the configured directory, and
an
+`IllegalArgumentException` is thrown if it does not.
+
+Object names are still allowed to contain `/` and are mapped to
sub-directories of the
+download directory as before, so nested object names keep working unchanged.
Only names
+that resolve outside the configured directory are rejected.
+
+If `downloadFileName` is configured with an expression (i.e. it contains `$`),
the local
+path is built by that expression as before and is not subject to this check.
