davsclaus opened a new pull request, #25991: URL: https://github.com/apache/camel/pull/25991
## Backport of #25873 Adaptation of #25873 onto `camel-4.18.x`. **Original PR:** #25873 - CAMEL-24548 CAMEL-24549: Harden cloud storage download containment **Original author:** @oscerd **Target branch:** `camel-4.18.x` ### Original description This hardens local download path containment in the Azure Blob/DataLake and Google Storage components by resolving existing filesystem path segments before accepting a destination. It preserves valid nested paths while rejecting linked paths that resolve beyond the configured directory. JIRA: - https://issues.apache.org/jira/browse/CAMEL-24548 - https://issues.apache.org/jira/browse/CAMEL-24549 ### Note on this backport **Not a mechanical cherry-pick.** `camel-4.18.x` predates the shared `camel-azure-common` module and `AzureFileNameHelper` introduced later — this module doesn't exist at all on this branch. Each Azure component instead has its own duplicated private `resolveWithinDirectory()` method (`BlobOperations` and `DataLakeFileOperations`), matching the pre-fix logic on `main` exactly. The same hardening (resolve existing path segments via `Files.exists(..., NOFOLLOW_LINKS)` + `toRealPath()` before the containment check) was applied directly to both duplicated methods, with equivalent new tests added to `BlobOperationsTest` and `DataLakeFileOperationTest` (via the public `downloadBlobToFile`/`downloadToFile` entry points, since there's no shared helper class to unit-test directly here). The Google fix is a direct, unmodified port: `GoogleCloudStorageFileNameHelper` on this branch is identical to its pre-fix state on `main`. As with the `camel-4.22.x` backport (#25990), the upgrade-guide entry was added to the existing "Upgrading from 4.18.4 to 4.18.5" section of `camel-4x-upgrade-guide-4_18.adoc`, since `camel-4x-upgrade-guide-4_23.adoc` doesn't exist on this branch. Verification on this branch: - `BlobOperationsTest`: 6 passed (incl. new symlink-containment test) - `DataLakeFileOperationTest`: 5 passed (incl. new symlink-containment test) - `GoogleCloudStorageFileNameHelperTest`: 10 passed - Full unit suites for all three modules: 33 + 16 + 30 tests, 0 failures Given the manual adaptation, this should go through a normal review rather than the no-review backport fast path. _Claude Code on behalf of davsclaus_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
