[
https://issues.apache.org/jira/browse/CAMEL-24293?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino resolved CAMEL-24293.
--------------------------------------
Resolution: Fixed
Fixed on main via PR https://github.com/apache/camel/pull/25218. Unmarshalling
tar/zip archives (and vertx multipart uploads) now sets CamelFileName to the
stripped entry base name to prevent Tar/Zip Slip; the full entry name remains
available on the dedicated headers (CamelTarFileEntryName for tar, zipFileName
for zip). Documented in the 4.22 upgrade guide. Main-only (4.22.0) as it
changes a default behaviour.
_Claude Code on behalf of Andrea Cosentino (@oscerd)._
> Strip path segments from externally-derived filenames before setting
> CamelFileName (platform-http-vertx, zipfile, tarfile)
> --------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24293
> URL: https://issues.apache.org/jira/browse/CAMEL-24293
> Project: Camel
> Issue Type: Improvement
> Components: camel-platform-http-vertx, camel-tarfile, camel-zipfile
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.22.0
>
>
> CamelFileName (Exchange.FILE_NAME) is consumed by file/ftp producers to pick
> the output filename. A few paths set it from an externally-derived name that
> may contain path segments, where other file-producing paths already normalise
> to a leaf name:
> - camel-platform-http-vertx: VertxPlatformHttpConsumer sets it from the raw
> multipart Content-Disposition filename (upload.fileName()).
> - camel-zipfile: ZipFileDataFormat / ZipIterator set it from the raw archive
> entry name.
> - camel-tarfile: TarFileDataFormat / TarIterator - same for TAR entries.
> Suggested: FileUtil.stripPath(...) on each. Non-breaking (legitimate leaf
> filenames unaffected); aligns these paths with the normalisation other
> producers apply.
> _Filed by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
