[
https://issues.apache.org/jira/browse/CAMEL-24487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18108329#comment-18108329
]
Andrea Cosentino commented on CAMEL-24487:
------------------------------------------
Fixed on all supported release lines.
* main (4.23.0): https://github.com/apache/camel/pull/25730 - commit
177fb1fdff90632ebfd27772a625b720c1cab3e7
* camel-4.22.x (4.22.1): https://github.com/apache/camel/pull/25745 - commit
b31b1754d26352ea823354c8660074aaba257c45
* camel-4.18.x (4.18.5): https://github.com/apache/camel/pull/25746 - commit
c1165e4e663c3c3edc7bd30451ecc213fcf68cfd
* Upgrade-guide sync on main for the 4_22 and 4_18 guides:
https://github.com/apache/camel/pull/25747 - commit
a7d7d3ad2e7f940ece35803a0929aa8215d91dfc
camel-4.14.x is end of life and is not targeted.
> camel-ftp/sftp/mina-sftp/azure-files/smb: contain remote consumer operations
> within the configured directory
> ------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24487
> URL: https://issues.apache.org/jira/browse/CAMEL-24487
> Project: Camel
> Issue Type: Improvement
> Components: camel-azure, camel-file, camel-ftp, camel-smb
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.22.1, 4.23.0, 4.18.5
>
>
> The remote-file consumers build the absolute remote path by concatenating the
> configured directory with the file name reported in the server directory
> listing, and then use that result as the operand for the subsequent retrieve,
> delete and rename operations. No lexical normalization or containment check
> is applied at any point between the listing and those operations, so a
> listing entry that is not a single path segment can resolve outside the
> configured directory.
> This is inconsistent with the file producer and with the localWorkDirectory
> download path, which both contain the resolved path via FileUtil.compactPath
> plus a path-boundary check when jailStartingDirectory=true (see CAMEL-23765
> and CAMEL-23868).
> This proposes extending the same containment check to the remote operand in
> camel-ftp (FTP, FTPS and SFTP), camel-mina-sftp, camel-azure-files and
> camel-smb, reusing GenericFileHelper.isWithinDirectory and gating it on the
> existing jailStartingDirectory option, so the consumer side behaves
> consistently with the producer and with the localWorkDirectory path.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
