(camel) branch camel-4.22.x updated: [backport camel-4.22.x] CAMEL-24893: camel-docling - reject absolute paths in custom-argument path validation (#26743)

[gnodet]

This is an automated email from the ASF dual-hosted git repository.

gnodet pushed a commit to branch camel-4.22.x
in repository https://gitbox.apache.org/repos/asf/camel.git


The following commit(s) were added to refs/heads/camel-4.22.x by this push:
     new e9233c37c612 [backport camel-4.22.x] CAMEL-24893: camel-docling - 
reject absolute paths in custom-argument path validation (#26743)
e9233c37c612 is described below

commit e9233c37c6127221157ac0901fb74250c5d24e98
Author: Guillaume Nodet <gno...@gmail.com>
AuthorDate: Tue Sep 22 16:41:17 2026 +0200

    [backport camel-4.22.x] CAMEL-24893: camel-docling - reject absolute paths 
in custom-argument path validation (#26743)
---
 .../camel/component/docling/DoclingProducer.java   | 11 +++++---
 .../docling/DoclingCustomArgsValidationTest.java   | 30 ++++++++++++++++++++++
 2 files changed, 38 insertions(+), 3 deletions(-)

diff --git 
a/components/camel-ai/camel-docling/src/main/java/org/apache/camel/component/docling/DoclingProducer.java
 
b/components/camel-ai/camel-docling/src/main/java/org/apache/camel/component/docling/DoclingProducer.java
index 6261d7665204..556f3ed5a1e5 100644
--- 
a/components/camel-ai/camel-docling/src/main/java/org/apache/camel/component/docling/DoclingProducer.java
+++ 
b/components/camel-ai/camel-docling/src/main/java/org/apache/camel/component/docling/DoclingProducer.java
@@ -2159,7 +2159,7 @@ public class DoclingProducer extends DefaultProducer {
 
     /**
      * Validates custom CLI arguments using an allowlist approach. Only 
recognized docling CLI flags are permitted.
-     * Producer-managed flags, shell metacharacters, and path traversal 
sequences are rejected.
+     * Producer-managed flags, shell metacharacters, absolute paths, and path 
traversal sequences are rejected.
      */
     private void validateCustomArguments(List<String> customArgs) {
         for (int i = 0; i < customArgs.size(); i++) {
@@ -2242,9 +2242,14 @@ public class DoclingProducer extends DefaultProducer {
             throw new IllegalArgumentException(
                     "Custom argument at index " + index + " contains a 
relative path traversal sequence");
         }
-        // Normalize path-like values to detect traversal via redundant 
separators
+        // Normalize path-like values to detect absolute paths or traversal 
via redundant separators
         if (value.contains("/") || value.contains("\\")) {
-            Path normalized = Paths.get(value).normalize();
+            Path path = Paths.get(value);
+            if (path.isAbsolute()) {
+                throw new IllegalArgumentException(
+                        "Custom argument at index " + index + " must not be an 
absolute path");
+            }
+            Path normalized = path.normalize();
             for (Path component : normalized) {
                 if ("..".equals(component.toString())) {
                     throw new IllegalArgumentException(
diff --git 
a/components/camel-ai/camel-docling/src/test/java/org/apache/camel/component/docling/DoclingCustomArgsValidationTest.java
 
b/components/camel-ai/camel-docling/src/test/java/org/apache/camel/component/docling/DoclingCustomArgsValidationTest.java
index adc83beb812e..96d331dff656 100644
--- 
a/components/camel-ai/camel-docling/src/test/java/org/apache/camel/component/docling/DoclingCustomArgsValidationTest.java
+++ 
b/components/camel-ai/camel-docling/src/test/java/org/apache/camel/component/docling/DoclingCustomArgsValidationTest.java
@@ -267,6 +267,36 @@ class DoclingCustomArgsValidationTest extends 
CamelTestSupport {
                 ex.getCause().getMessage().contains("traversal after 
normalization"));
     }
 
+    @Test
+    void customArgsWithAbsolutePathAreRejected() throws Exception {
+        Path inputFile = createInputFile();
+
+        // An absolute path contains no relative traversal sequence and no 
".." component after
+        // normalization, so it must be rejected by the explicit absolute-path 
check.
+        CamelExecutionException ex = 
assertThrows(CamelExecutionException.class, () -> {
+            template.requestBodyAndHeaders("direct:cli-convert",
+                    inputFile.toString(),
+                    Map.of(DoclingHeaders.CUSTOM_ARGUMENTS, 
List.of("--artifacts-path", "/etc/cron.d")));
+        });
+
+        assertInstanceOf(IllegalArgumentException.class, ex.getCause());
+        assertTrue(ex.getCause().getMessage().contains("absolute path"));
+    }
+
+    @Test
+    void customArgsWithAbsolutePathEqualsFormAreRejected() throws Exception {
+        Path inputFile = createInputFile();
+
+        CamelExecutionException ex = 
assertThrows(CamelExecutionException.class, () -> {
+            template.requestBodyAndHeaders("direct:cli-convert",
+                    inputFile.toString(),
+                    Map.of(DoclingHeaders.CUSTOM_ARGUMENTS, 
List.of("--artifacts-path=/var/www/html/uploads")));
+        });
+
+        assertInstanceOf(IllegalArgumentException.class, ex.getCause());
+        assertTrue(ex.getCause().getMessage().contains("absolute path"));
+    }
+
     private Path createInputFile() throws Exception {
         Path file = tempDir.resolve("test-input.txt");
         Files.writeString(file, "test content");