[
https://issues.apache.org/jira/browse/CAMEL-24487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino resolved CAMEL-24487.
--------------------------------------
Resolution: Fixed
> camel-ftp/sftp/mina-sftp/azure-files/smb: contain remote consumer operations
> within the configured directory
> ------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24487
> URL: https://issues.apache.org/jira/browse/CAMEL-24487
> Project: Camel
> Issue Type: Improvement
> Components: camel-azure, camel-file, camel-ftp, camel-smb
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.22.1, 4.23.0, 4.18.5
>
>
> The remote-file consumers build the absolute remote path by concatenating the
> configured directory with the file name reported in the server directory
> listing, and then use that result as the operand for the subsequent retrieve,
> delete and rename operations. No lexical normalization or containment check
> is applied at any point between the listing and those operations, so a
> listing entry that is not a single path segment can resolve outside the
> configured directory.
> This is inconsistent with the file producer and with the localWorkDirectory
> download path, which both contain the resolved path via FileUtil.compactPath
> plus a path-boundary check when jailStartingDirectory=true (see CAMEL-23765
> and CAMEL-23868).
> This proposes extending the same containment check to the remote operand in
> camel-ftp (FTP, FTPS and SFTP), camel-mina-sftp, camel-azure-files and
> camel-smb, reusing GenericFileHelper.isWithinDirectory and gating it on the
> existing jailStartingDirectory option, so the consumer side behaves
> consistently with the producer and with the localWorkDirectory path.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
