This is an automated email from the ASF dual-hosted git repository.
Croway pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 6eb7f6c9a907 CAMEL-25163: docs - upgrade guide entries for the
camel-google-storage object name and downloadFileName expression checks in
4.22.3 and 4.18.6 (#28686)
6eb7f6c9a907 is described below
commit 6eb7f6c9a90761d00e1fefb06c1ec6756b740c28
Author: Federico Mariani <[email protected]>
AuthorDate: Thu Oct 29 13:15:02 2026 +0100
CAMEL-25163: docs - upgrade guide entries for the camel-google-storage
object name and downloadFileName expression checks in 4.22.3 and 4.18.6 (#28686)
The change is backported to camel-4.22.x and camel-4.18.x, so add the same
text as the camel-google-storage entry of the 4.23 upgrade guide under
"Upgrading from 4.22.2 to 4.22.3" and "Upgrading from 4.18.5 to 4.18.6". The
paragraph of that entry about symbolic links is left out, as the 4.22.1 and
4.18.5 sections already describe it.
---
.../ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 18 ++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 18 ++++++++++++++++++
2 files changed, 36 insertions(+)
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index 3c06cfd01317..a5e787ab3582 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -519,6 +519,24 @@ identifier upon successful authentication, replacing the
pre-login session ident
and emitting an updated session cookie. The default `rotateSession` method of
`OAuthSessionStore` keeps the session
unchanged, so a custom `OAuthSessionStore` must override it to rotate the
session identifier on login.
+=== camel-google-storage - object names are checked, and an expression in
downloadFileName is confined
+
+The remote object name is untrusted input, so the consumer now also checks it
whatever `downloadFileName`
+looks like. An absolute object name (one starting with `/` or `\`, or with a
drive letter such as `C:`) and
+an object name with a `..` path segment are rejected, even when the name would
normalize back inside the
+download directory (for example `a/../b.txt`). When the consumer lists the
bucket, a rejected object is skipped
+and reported to the consumer's exception handler, which logs a warning by
default, and the other objects of the
+poll are consumed as usual. The rejected object stays in the bucket, so it is
reported again on every poll until it
+is removed or renamed. With `objectName`, which consumes a single object, the
poll fails instead, and the failure is
+reported on every poll.
+
+The containment check is now also applied when `downloadFileName` is
configured as a directory followed
+by an expression, such as `downloadFileName=/tmp/downloads/${file:name}`: the
destination must stay within
+the static directory prefix configured before the first expression token
(`/tmp/downloads` in the example).
+When `downloadFileName` is fully dynamic and has no static directory prefix
(for example
+`downloadFileName=${file:name}`), a relative destination must stay within the
working directory. An absolute
+destination that comes from the route's own expression is not confined.
+
== Upgrading from 4.18.4 to 4.18.5
=== camel-azure-eventhubs
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index d067442e5fca..422f0a8ce19e 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -370,6 +370,24 @@ version, with a warning. When the CLI is newer than all
the releases, or the rel
`--version` and `--gav` are used as given, with a warning when the release is
built for another Camel version. Plugins
registered before are not changed. See
xref:camel-jbang-projects.adoc#_plugin_versions[Plugin versions].
+=== camel-google-storage - object names are checked, and an expression in
downloadFileName is confined
+
+The remote object name is untrusted input, so the consumer now also checks it
whatever `downloadFileName`
+looks like. An absolute object name (one starting with `/` or `\`, or with a
drive letter such as `C:`) and
+an object name with a `..` path segment are rejected, even when the name would
normalize back inside the
+download directory (for example `a/../b.txt`). When the consumer lists the
bucket, a rejected object is skipped
+and reported to the consumer's exception handler, which logs a warning by
default, and the other objects of the
+poll are consumed as usual. The rejected object stays in the bucket, so it is
reported again on every poll until it
+is removed or renamed. With `objectName`, which consumes a single object, the
poll fails instead, and the failure is
+reported on every poll.
+
+The containment check is now also applied when `downloadFileName` is
configured as a directory followed
+by an expression, such as `downloadFileName=/tmp/downloads/${file:name}`: the
destination must stay within
+the static directory prefix configured before the first expression token
(`/tmp/downloads` in the example).
+When `downloadFileName` is fully dynamic and has no static directory prefix
(for example
+`downloadFileName=${file:name}`), a relative destination must stay within the
working directory. An absolute
+destination that comes from the route's own expression is not confined.
+
== Upgrading from 4.22.1 to 4.22.2
=== camel-lra - only an LRA hosted by the configured coordinator is joined
