davsclaus commented on code in PR #25730:
URL: https://github.com/apache/camel/pull/25730#discussion_r3855424743
##########
components/camel-smb/src/main/java/org/apache/camel/component/smb/SmbConsumer.java:
##########
@@ -71,6 +77,21 @@ public GenericFileEndpoint<FileIdBothDirectoryInformation>
getEndpoint() {
return (GenericFileEndpoint<FileIdBothDirectoryInformation>)
super.getEndpoint();
}
+ /**
+ * The file name comes from the directory listing returned by the remote
share and is not guaranteed to be a single
+ * path segment, so the path resolved from it is compacted and checked to
still be inside the directory being polled
+ * before the file is accepted for retrieval, deletion or renaming.
+ */
+ @Override
+ protected boolean isWithinStartingDirectory(String absoluteFilePath) {
Review Comment:
Unlike `RemoteFileConsumer` (covered by the new
`RemoteFileConsumerStartingDirectoryJailTest` in `camel-ftp`, which
transitively covers `camel-ftp`, `camel-mina-sftp` and `camel-azure-files`
since they extend it unchanged), this override is SMB-specific and implemented
differently — it resolves the boundary from the `endpointPath` field captured
at construction rather than a live configuration lookup. There's no test in
`camel-smb/src/test/` exercising this method or verifying SMB share paths are
actually contained. Since this is the security-sensitive path this PR adds,
it'd be good to have direct unit coverage here the same way the FTP/SFTP path
has it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
