oscerd opened a new pull request, #25746: URL: https://github.com/apache/camel/pull/25746
Backport of #25730 (CAMEL-24487) to `camel-4.18.x`. The remote-file consumers build the absolute remote path by concatenating the configured directory with the file name reported in the server directory listing, and then use that result as the operand for the subsequent retrieve, delete and rename operations. No lexical normalization or containment check was applied between the listing and those operations, so a listing entry that is not a single path segment could resolve outside the configured directory. Adds a separator-aware `GenericFileHelper.isWithinDirectory` overload (remote paths always use `/` regardless of platform) and a `GenericFileConsumer.isWithinStartingDirectory` strategy consulted from `isValidFile` when `jailStartingDirectory` is enabled. The base implementation is a no-op for local directory listings; `RemoteFileConsumer` and `SmbConsumer` override it. A file resolving outside the polled directory is skipped with a warning. Two divergences from main, both handled: `camel-ftp-common` does not exist on this branch, so `RemoteFileConsumer` lives in `camel-ftp` (all four of FtpConsumer, SftpConsumer, MinaSftpConsumer and FilesConsumer still extend it, so coverage is unchanged); and this branch is on JUnit 5, so the new test's `CamelTestSupport` import was rewritten from `junit6` to `junit5`. **No upgrade-guide edit here** — the version-specific guides for all release lines are maintained on `main`. The matching note is added there in a separate doc-sync PR. **Testing:** `camel-ftp` suite 60 tests / 0 failures; `core/camel-core` file tests 395 / 0 failures; the new `RemoteFileConsumerStartingDirectoryJailTest` (4 tests) green; camel-file, camel-ftp and camel-smb all build. --- _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
