oscerd opened a new pull request, #25745: URL: https://github.com/apache/camel/pull/25745
Backport of #25730 (CAMEL-24487) to `camel-4.22.x`. The remote-file consumers build the absolute remote path by concatenating the configured directory with the file name reported in the server directory listing, and then use that result as the operand for the subsequent retrieve, delete and rename operations. No lexical normalization or containment check was applied between the listing and those operations, so a listing entry that is not a single path segment could resolve outside the configured directory. Adds a separator-aware `GenericFileHelper.isWithinDirectory` overload (remote paths always use `/` regardless of platform) and a `GenericFileConsumer.isWithinStartingDirectory` strategy consulted from `isValidFile` when `jailStartingDirectory` is enabled. The base implementation is a no-op for local directory listings; `RemoteFileConsumer` and `SmbConsumer` override it. A file resolving outside the polled directory is skipped with a warning. Cherry-picked cleanly; `camel-ftp-common` exists on this branch so the change lands there, same as main. **No upgrade-guide edit here** — the version-specific guides for all release lines are maintained on `main`. The matching note is added there in a separate doc-sync PR. **Testing:** `camel-ftp` full suite 78 tests / 0 failures; `GenericFileHelperTest` and the new `RemoteFileConsumerStartingDirectoryJailTest` (4 tests) green; camel-file, camel-ftp-common, camel-ftp and camel-smb all build. --- _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
