[jira] [Created] (CAMEL-24279) camel-google-storage: contain downloadFileName downloads within the configured directory

["Andrea Cosentino (Jira)" <ji...@apache.org>]

Andrea Cosentino created CAMEL-24279:
----------------------------------------

             Summary: camel-google-storage: contain downloadFileName downloads within the configured directory
                 Key: CAMEL-24279
                 URL: https://issues.apache.org/jira/browse/CAMEL-24279
             Project: Camel
          Issue Type: Improvement
          Components: camel-google-storage
            Reporter: Andrea Cosentino
            Assignee: Andrea Cosentino


{{GoogleCloudStorageConsumer}} builds the local download destination by appending the remote object name to the configured {{downloadFileName}} directory via the {{${file:name}}} token, which returns the name unchanged. A remote object name containing path segments can therefore resolve outside the configured directory.

Add a containment check so the resolved destination is verified to remain within the configured {{downloadFileName}} directory, rejecting anything that resolves outside it.

This brings the component in line with the containment already applied to:
* the file/FTP/SFTP/SMB consumers (CAMEL-23765, CAMEL-23868)
* the Azure Storage Blob/DataLake download paths (CAMEL-23942)

Notes:
* Prefer a containment check over stripping the path component: Google Cloud Storage object names legitimately use {{/}} as pseudo-directory separators, so stripping would flatten nested names and could cause collisions for existing users.
* The branch where the user supplies their own expression in {{downloadFileName}} (i.e. it already contains {{$}}) is out of scope - that path is explicitly constructed by the route author.
* Add unit tests covering object names containing parent-directory segments, and an upgrade-guide note.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)