davsclaus commented on code in PR #26738:
URL: https://github.com/apache/camel/pull/26738#discussion_r4071662932
##########
components/camel-ai/camel-docling/src/main/java/org/apache/camel/component/docling/DoclingProducer.java:
##########
@@ -2242,9 +2242,14 @@ private static void validatePathSafety(String value, int
index) {
throw new IllegalArgumentException(
"Custom argument at index " + index + " contains a
relative path traversal sequence");
}
- // Normalize path-like values to detect traversal via redundant
separators
+ // Normalize path-like values to detect absolute paths or traversal
via redundant separators
if (value.contains("/") || value.contains("\\")) {
- Path normalized = Paths.get(value).normalize();
+ Path path = Paths.get(value);
+ if (path.isAbsolute()) {
Review Comment:
🟡 `Path.isAbsolute()` is evaluated by the default filesystem, so what counts
as absolute depends on where the JVM runs: on Linux `C:\\Windows\\System32` and
`\\\\server\\share` are *not* absolute, and on Windows `/etc/passwd` is not
absolute either (no drive letter).
In practice the docling CLI runs on the same host, so the platform matches
and the gap is mostly theoretical. But if this check is meant as a hard
boundary rather than a best-effort one, a platform-independent test — e.g. also
rejecting a leading `/` or `\\`, or a `<letter>:` prefix, regardless of the
current filesystem — would hold on both.
Worth at least a comment recording that the check is filesystem-dependent,
so the next reader doesn't assume otherwise.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
