Andrea Cosentino created CAMEL-23942:
----------------------------------------
Summary: camel-azure-storage-blob / camel-azure-storage-datalake:
contain fileDir downloads within the configured directory
Key: CAMEL-23942
URL: https://issues.apache.org/jira/browse/CAMEL-23942
Project: Camel
Issue Type: Improvement
Components: camel-azure
Reporter: Andrea Cosentino
The remote-file consumers (camel-file, camel-ftp, camel-smb, camel-mina-sftp)
and camel-azure-files contain their local downloads within the configured local
directory using a path-segment boundary check -- see the containment behavior
added in CAMEL-23765 and made boundary-aware in CAMEL-23868
(GenericFileHelper.isWithinDirectory / jailToLocalWorkDirectory).
The Azure Storage Blob and DataLake consumers do not apply an equivalent check.
When fileDir is configured, the local download target is built directly from
the remote object name:
* BlobOperations.downloadBlobToFile -- new File(fileDir, client.getBlobName())
(BlobOperations.java:156), passed to downloadToFileWithResponse at :164.
* DataLakeFileOperations.downloadToFile -- new File(fileDir,
fileClientWrapper.getFileName()) (DataLakeFileOperations.java:109), passed to
downloadToFileWithResponse at :116.
A remote object name may contain ../ segments, which resolve to a location
outside fileDir. For consistency with the rest of the file-download consumer
family, the resolved target should be constrained to stay within fileDir.
Proposed change:
* Before invoking downloadToFileWithResponse in both operations classes,
compact the resolved target path and the configured fileDir, and verify the
target remains within fileDir using a path-segment boundary comparison; fail
the operation otherwise.
* These two modules do not depend on camel-file, so GenericFileHelper cannot be
reused directly. Either extract the small boundary check into a shared
low-level module (e.g. camel-util/camel-support) or replicate the equivalent
compact-path boundary check locally in both classes.
* Add unit tests covering an object name containing ../ segments and asserting
the resolved path stays within fileDir.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
