[
https://issues.apache.org/jira/browse/CAMEL-23942?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18095299#comment-18095299
]
Andrea Cosentino commented on CAMEL-23942:
------------------------------------------
Fixed on main and backported to the 4.18.x and 4.14.x maintenance branches:
* main (4.22.0): https://github.com/apache/camel/pull/24542
* camel-4.18.x (4.18.4): https://github.com/apache/camel/pull/24581
* camel-4.14.x (4.14.9): https://github.com/apache/camel/pull/24582
* upgrade-guide doc-sync to main: https://github.com/apache/camel/pull/24585
_Comment generated by Claude Code on behalf of Andrea Cosentino._
> camel-azure-storage-blob / camel-azure-storage-datalake: contain fileDir
> downloads within the configured directory
> ------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-23942
> URL: https://issues.apache.org/jira/browse/CAMEL-23942
> Project: Camel
> Issue Type: Improvement
> Components: camel-azure
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.14.9, 4.18.4, 4.22.0
>
>
> The remote-file consumers (camel-file, camel-ftp, camel-smb, camel-mina-sftp)
> and camel-azure-files contain their local downloads within the configured
> local directory using a path-segment boundary check -- see the containment
> behavior added in CAMEL-23765 and made boundary-aware in CAMEL-23868
> (GenericFileHelper.isWithinDirectory / jailToLocalWorkDirectory).
> The Azure Storage Blob and DataLake consumers do not apply an equivalent
> check. When fileDir is configured, the local download target is built
> directly from the remote object name:
> * BlobOperations.downloadBlobToFile -- new File(fileDir,
> client.getBlobName()) (BlobOperations.java:156), passed to
> downloadToFileWithResponse at :164.
> * DataLakeFileOperations.downloadToFile -- new File(fileDir,
> fileClientWrapper.getFileName()) (DataLakeFileOperations.java:109), passed to
> downloadToFileWithResponse at :116.
> A remote object name may contain ../ segments, which resolve to a location
> outside fileDir. For consistency with the rest of the file-download consumer
> family, the resolved target should be constrained to stay within fileDir.
> Proposed change:
> * Before invoking downloadToFileWithResponse in both operations classes,
> compact the resolved target path and the configured fileDir, and verify the
> target remains within fileDir using a path-segment boundary comparison; fail
> the operation otherwise.
> * These two modules do not depend on camel-file, so GenericFileHelper cannot
> be reused directly. Either extract the small boundary check into a shared
> low-level module (e.g. camel-util/camel-support) or replicate the equivalent
> compact-path boundary check locally in both classes.
> * Add unit tests covering an object name containing ../ segments and
> asserting the resolved path stays within fileDir.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
