[
https://issues.apache.org/jira/browse/CAMEL-24279?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino resolved CAMEL-24279.
--------------------------------------
Resolution: Fixed
Fixed on main (PR #25179), backported to camel-4.18.x (#25180) and camel-4.14.x
(#25181); upgrade-guide notes synced to main (#25182). The download now
contains downloadFileName within the target directory (path-traversal
containment).
_Claude Code on behalf of Andrea Cosentino (@oscerd)._
> camel-google-storage: contain downloadFileName downloads within the
> configured directory
> ----------------------------------------------------------------------------------------
>
> Key: CAMEL-24279
> URL: https://issues.apache.org/jira/browse/CAMEL-24279
> Project: Camel
> Issue Type: Improvement
> Components: camel-google-storage
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.14.9, 4.18.4, 4.22.0
>
>
> {{GoogleCloudStorageConsumer}} builds the local download destination by
> appending the remote object name to the configured {{downloadFileName}}
> directory via the {{${file:name}}} token, which returns the name unchanged. A
> remote object name containing path segments can therefore resolve outside the
> configured directory.
> Add a containment check so the resolved destination is verified to remain
> within the configured {{downloadFileName}} directory, rejecting anything that
> resolves outside it.
> This brings the component in line with the containment already applied to:
> * the file/FTP/SFTP/SMB consumers (CAMEL-23765, CAMEL-23868)
> * the Azure Storage Blob/DataLake download paths (CAMEL-23942)
> Notes:
> * Prefer a containment check over stripping the path component: Google Cloud
> Storage object names legitimately use {{/}} as pseudo-directory separators,
> so stripping would flatten nested names and could cause collisions for
> existing users.
> * The branch where the user supplies their own expression in
> {{downloadFileName}} (i.e. it already contains {{$}}) is out of scope - that
> path is explicitly constructed by the route author.
> * Add unit tests covering object names containing parent-directory segments,
> and an upgrade-guide note.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
