[PR] [backport camel-4.18.x] CAMEL-23942: contain Azure Storage Blob/DataLake fileDir downloads within the configured directory [camel]

["oscerd (via GitHub)" <gi...@apache.org>]

oscerd opened a new pull request, #24581:
URL: https://github.com/apache/camel/pull/24581

   Backport of #24542 to `camel-4.18.x`.
   
   ## What
   
   When `fileDir` is configured, the Azure Storage Blob and DataLake consumers build the local download target from the remote object name via `new File(fileDir, name)` with no containment check, so a name containing `../` segments could resolve to a location outside `fileDir`. This aligns them with the containment already performed by the file-based consumers.
   
   ## How
   
   `camel-azure-common` does not exist on this branch (it was introduced in 4.19), so the shared `AzureFileNameHelper` from the main-branch fix cannot be reused here. Instead, the same guard is added as a small `private static` method in each of `BlobOperations` and `DataLakeFileOperations`: it resolves the name against `fileDir`, normalizes lexically, and verifies the result stays within `fileDir` on path-segment boundaries (`java.nio.file`), throwing `IllegalArgumentException` otherwise.
   
   ## Tests
   
   - Wiring test in `BlobOperationsTest` / `DataLakeFileOperationTest` asserting a `../`-bearing object name is rejected at the download call site.
   
   ## Notes
   
   - Upgrade-guide note added to `camel-4x-upgrade-guide-4_18.adoc`. The matching entry will also be synced to `main`'s copy of that guide per the backport upgrade-guide policy.
   
   ---
   _Claude Code on behalf of oscerd_
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [backport camel-4.18.x] CAMEL-23942: contain Azure Storage Blob/DataLake fileDir downloads within the configured directory [camel]

["oscerd (via GitHub)" <gi...@apache.org>]

oscerd merged PR #24581:
URL: https://github.com/apache/camel/pull/24581


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org