Andrea Cosentino created CAMEL-24487:
----------------------------------------
Summary: camel-ftp/sftp/mina-sftp/azure-files/smb: contain remote
consumer operations within the configured directory
Key: CAMEL-24487
URL: https://issues.apache.org/jira/browse/CAMEL-24487
Project: Camel
Issue Type: Improvement
Components: camel-ftp, camel-file, camel-azure, camel-smb
Reporter: Andrea Cosentino
The remote-file consumers build the absolute remote path by concatenating the
configured directory with the file name reported in the server directory
listing, and then use that result as the operand for the subsequent retrieve,
delete and rename operations. No lexical normalization or containment check is
applied at any point between the listing and those operations, so a listing
entry that is not a single path segment can resolve outside the configured
directory.
This is inconsistent with the file producer and with the localWorkDirectory
download path, which both contain the resolved path via FileUtil.compactPath
plus a path-boundary check when jailStartingDirectory=true (see CAMEL-23765 and
CAMEL-23868).
This proposes extending the same containment check to the remote operand in
camel-ftp (FTP, FTPS and SFTP), camel-mina-sftp, camel-azure-files and
camel-smb, reusing GenericFileHelper.isWithinDirectory and gating it on the
existing jailStartingDirectory option, so the consumer side behaves
consistently with the producer and with the localWorkDirectory path.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
