This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new a7d7d3ad2e7f CAMEL-24487: sync the remote-file consumer containment
note to the 4.22/4.18 upgrade guides (#25747)
a7d7d3ad2e7f is described below
commit a7d7d3ad2e7f940ece35803a0929aa8215d91dfc
Author: Andrea Cosentino <[email protected]>
AuthorDate: Wed Aug 26 15:53:12 2026 +0200
CAMEL-24487: sync the remote-file consumer containment note to the
4.22/4.18 upgrade guides (#25747)
Follow-up to #25730 and its backports #25745 (camel-4.22.x) and #25746
(camel-4.18.x).
The version-specific upgrade guides for all release lines are maintained on
main, so the backports carry no guide edit of their own. Adds the matching note
to the 4_22 and 4_18 guides.
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
.../ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 19 +++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 19 +++++++++++++++++++
2 files changed, 38 insertions(+)
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index d0ff95a15bda..91c7ffaaafbf 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -11,6 +11,25 @@ Note that manual migration is still required.
See the xref:camel-upgrade-recipes-tool.adoc[documentation] page for details.
====
+== Upgrading from 4.18.4 to 4.18.5
+
+=== camel-ftp, camel-sftp, camel-ftps, camel-mina-sftp, camel-azure-files,
camel-smb
+
+The remote-file consumers now ensure the path resolved for a polled file stays
within the directory being
+polled. The file name that path is built from is reported by the remote server
in its directory listing and is
+not guaranteed to be a single path segment, so a listing entry containing
`../` sequences could previously
+resolve to a path outside the configured directory and be used as the operand
for retrieving, deleting or
+renaming a file.
+
+The containment check honours the existing `jailStartingDirectory` option
(default `true`), consistent with the
+file producer and with the `localWorkDirectory` download path; set
`jailStartingDirectory=false` to disable it.
+A file that resolves outside the configured directory is now skipped, and a
warning is logged.
+
+Ordinary listings are unaffected, as a listed name is normally a single path
segment, and a `../` that still
+resolves back inside the polled directory remains accepted. Two configurations
can newly see files skipped: a
+server that reports names navigating above the polled directory, and a
`fileName` expression (used when
+`useList=false`) that navigates above it. Set `jailStartingDirectory=false` if
such a path is intended.
+
== Upgrading from 4.18.3 to 4.18.4
=== camel-core - Multicast EIP honors UseOriginalAggregationStrategy
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index da5d4261420f..23e935c80a7b 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -11,6 +11,25 @@ Note that manual migration is still required.
See the xref:camel-upgrade-recipes-tool.adoc[documentation] page for details.
====
+== Upgrading from 4.22.0 to 4.22.1
+
+=== camel-ftp, camel-sftp, camel-ftps, camel-mina-sftp, camel-azure-files,
camel-smb
+
+The remote-file consumers now ensure the path resolved for a polled file stays
within the directory being
+polled. The file name that path is built from is reported by the remote server
in its directory listing and is
+not guaranteed to be a single path segment, so a listing entry containing
`../` sequences could previously
+resolve to a path outside the configured directory and be used as the operand
for retrieving, deleting or
+renaming a file.
+
+The containment check honours the existing `jailStartingDirectory` option
(default `true`), consistent with the
+file producer and with the `localWorkDirectory` download path; set
`jailStartingDirectory=false` to disable it.
+A file that resolves outside the configured directory is now skipped, and a
warning is logged.
+
+Ordinary listings are unaffected, as a listed name is normally a single path
segment, and a `../` that still
+resolves back inside the polled directory remains accepted. Two configurations
can newly see files skipped: a
+server that reports names navigating above the polled directory, and a
`fileName` expression (used when
+`useList=false`) that navigates above it. Set `jailStartingDirectory=false` if
such a path is intended.
+
== Upgrading Camel 4.21 to 4.22
=== camel-reactive-executor-tomcat
