[
https://issues.apache.org/jira/browse/CAMEL-24279?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-24279 started by Andrea Cosentino.
------------------------------------------------
> camel-google-storage: contain downloadFileName downloads within the
> configured directory
> ----------------------------------------------------------------------------------------
>
> Key: CAMEL-24279
> URL: https://issues.apache.org/jira/browse/CAMEL-24279
> Project: Camel
> Issue Type: Improvement
> Components: camel-google-storage
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
>
> {{GoogleCloudStorageConsumer}} builds the local download destination by
> appending the remote object name to the configured {{downloadFileName}}
> directory via the {{${file:name}}} token, which returns the name unchanged. A
> remote object name containing path segments can therefore resolve outside the
> configured directory.
> Add a containment check so the resolved destination is verified to remain
> within the configured {{downloadFileName}} directory, rejecting anything that
> resolves outside it.
> This brings the component in line with the containment already applied to:
> * the file/FTP/SFTP/SMB consumers (CAMEL-23765, CAMEL-23868)
> * the Azure Storage Blob/DataLake download paths (CAMEL-23942)
> Notes:
> * Prefer a containment check over stripping the path component: Google Cloud
> Storage object names legitimately use {{/}} as pseudo-directory separators,
> so stripping would flatten nested names and could cause collisions for
> existing users.
> * The branch where the user supplies their own expression in
> {{downloadFileName}} (i.e. it already contains {{$}}) is out of scope - that
> path is explicitly constructed by the route author.
> * Add unit tests covering object names containing parent-directory segments,
> and an upgrade-guide note.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
