oscerd opened a new pull request, #25873: URL: https://github.com/apache/camel/pull/25873
This hardens local download path containment in the Azure Blob/DataLake and Google Storage components by resolving existing filesystem path segments before accepting a destination. It preserves valid nested paths while rejecting linked paths that resolve beyond the configured directory. The change includes focused tests for direct linked paths and linked-path/parent-segment composition, plus 4.23 upgrade-guide notes. JIRA: - https://issues.apache.org/jira/browse/CAMEL-24548 - https://issues.apache.org/jira/browse/CAMEL-24549 Verification: - Azure helper tests: 8 passed - Google helper and consumer path tests: 14 passed before rebasing to 4.23.0-SNAPSHOT - Current 4.23 focused reactor verification is blocked before reaching Google by an unrelated camel-xml-io SchemaGen failure involving missing org.apache.camel.cloud types - git diff --check: clean Backport assessment: - camel-4.22.x: recommended for both components; shared Azure helper exists - camel-4.18.x: recommended for both components; Google is straightforward, while Azure requires adapting the change to the duplicated Blob/DataLake helpers _Generated by Codex via OSS Helper on behalf of oscerd_ Co-authored-by: Codex <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
