luigidemasi commented on code in PR #28214:
URL: https://github.com/apache/camel/pull/28214#discussion_r4334303115
##########
components/camel-ftp/src/main/java/org/apache/camel/component/file/remote/SftpOperations.java:
##########
@@ -939,6 +939,42 @@ public SftpRemoteFile[] listFiles(String path) throws
GenericFileOperationFailed
}
}
+ @Override
+ public String getHomeDirectory() throws
GenericFileOperationFailedException {
+ lock.lock();
+ try {
+ return channel.getHome();
+ } catch (SftpException e) {
+ throw new GenericFileOperationFailedException("Cannot get the home
directory", e);
+ } finally {
+ lock.unlock();
+ }
+ }
+
+ @Override
+ public boolean isSymbolicLink(String path) throws
GenericFileOperationFailedException {
+ lock.lock();
+ try {
+ return channel.lstat(path).isLink();
Review Comment:
[P1] Preserve literal paths in both JSch link operations
`ChannelSftp.lstat(path)` and `ChannelSftp.readlink(path)` call JSch's
`isUnique`/`glob_remote`, which interpret wildcard syntax and remove backslash
escaping. These calls therefore do not necessarily inspect the literal path
that `resolveSymbolicLinks` is checking.
For example, with a directory named `pivotx` inside the starting directory,
a distinct symbolic link named `pivot\x` pointing outside it, and `latest.txt`
pointing to `pivot\x/report.txt`, the new checks inspect `pivotx/report.txt`
while the server follows the stored target through `pivot\x`. I reproduced the
outside file's contents reaching the route with the default jail enabled in
both stepwise modes. The equivalent MINA probes reject the link. This does not
require a check/use race or a malicious server.
Quote literal paths for JSch's pattern semantics before both `lstat` and
`readlink`, or use an API with literal-path semantics. Add real-server
regression tests for backslashes and wildcard characters, including valid
inside links and rejected outside targets. The current map-based stub does not
exercise JSch's path interpretation.
Source checked: [JSch 2.28.7
ChannelSftp](https://github.com/mwiede/jsch/blob/jsch-2.28.7/src/main/java/com/jcraft/jsch/ChannelSftp.java).
_AI-generated review by Codex on behalf of @luigidemasi._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
