[jira] [Resolved] (CAMEL-24487) camel-ftp/sftp/mina-sftp/azure-files/smb: contain remote consumer operations within the configured directory

["Andrea Cosentino (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andrea Cosentino resolved CAMEL-24487.
--------------------------------------
    Resolution: Fixed

> camel-ftp/sftp/mina-sftp/azure-files/smb: contain remote consumer operations within the configured directory
> ------------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24487
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24487
>             Project: Camel
>          Issue Type: Improvement
>          Components: camel-azure, camel-file, camel-ftp, camel-smb
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.22.1, 4.23.0, 4.18.5
>
>
> The remote-file consumers build the absolute remote path by concatenating the configured directory with the file name reported in the server directory listing, and then use that result as the operand for the subsequent retrieve, delete and rename operations. No lexical normalization or containment check is applied at any point between the listing and those operations, so a listing entry that is not a single path segment can resolve outside the configured directory.
> This is inconsistent with the file producer and with the localWorkDirectory download path, which both contain the resolved path via FileUtil.compactPath plus a path-boundary check when jailStartingDirectory=true (see CAMEL-23765 and CAMEL-23868).
> This proposes extending the same containment check to the remote operand in camel-ftp (FTP, FTPS and SFTP), camel-mina-sftp, camel-azure-files and camel-smb, reusing GenericFileHelper.isWithinDirectory and gating it on the existing jailStartingDirectory option, so the consumer side behaves consistently with the producer and with the localWorkDirectory path.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)