[
https://issues.apache.org/jira/browse/CAMEL-24487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18108173#comment-18108173
]
Andrea Cosentino commented on CAMEL-24487:
------------------------------------------
Merged on main via https://github.com/apache/camel/pull/25730 (4.23.0).
Backports open: https://github.com/apache/camel/pull/25745 (camel-4.22.x) and
https://github.com/apache/camel/pull/25746 (camel-4.18.x). Upgrade-guide sync
for the 4.22/4.18 guides on main: https://github.com/apache/camel/pull/25747.
fixVersions for 4.22.1 and 4.18.5 will be added once those backports merge.
camel-4.14.x is EOL and is not targeted.
> camel-ftp/sftp/mina-sftp/azure-files/smb: contain remote consumer operations
> within the configured directory
> ------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24487
> URL: https://issues.apache.org/jira/browse/CAMEL-24487
> Project: Camel
> Issue Type: Improvement
> Components: camel-azure, camel-file, camel-ftp, camel-smb
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> The remote-file consumers build the absolute remote path by concatenating the
> configured directory with the file name reported in the server directory
> listing, and then use that result as the operand for the subsequent retrieve,
> delete and rename operations. No lexical normalization or containment check
> is applied at any point between the listing and those operations, so a
> listing entry that is not a single path segment can resolve outside the
> configured directory.
> This is inconsistent with the file producer and with the localWorkDirectory
> download path, which both contain the resolved path via FileUtil.compactPath
> plus a path-boundary check when jailStartingDirectory=true (see CAMEL-23765
> and CAMEL-23868).
> This proposes extending the same containment check to the remote operand in
> camel-ftp (FTP, FTPS and SFTP), camel-mina-sftp, camel-azure-files and
> camel-smb, reusing GenericFileHelper.isWithinDirectory and gating it on the
> existing jailStartingDirectory option, so the consumer side behaves
> consistently with the producer and with the localWorkDirectory path.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
