Croway opened a new pull request, #28685: URL: https://github.com/apache/camel/pull/28685
Jira: https://issues.apache.org/jira/browse/CAMEL-25163 Backport of #27119 to `camel-4.18.x` (cherry-pick of b049bc9e49f0). The consumer now checks the object name whatever `downloadFileName` looks like: an absolute object name and an object name with a `..` path segment are rejected. When `downloadFileName` is a directory followed by an expression, such as `/tmp/downloads/${file:name}`, the download must also stay within that directory. When the consumer lists the bucket, an object whose name is rejected is skipped and reported to the consumer's exception handler, and the other objects of the poll are consumed as usual. - The code and the tests apply unchanged. The only conflict was `camel-4x-upgrade-guide-4_23.adoc`, which does not exist on this branch, so it is left out. The upgrade guide entry for 4.18.6 is added on `main` in a separate doc-sync PR. - The tests keep the `camel-test-junit5` `CamelTestSupport` used on this branch. Tests: `components/camel-google/camel-google-storage` `mvn -Psourcecheck verify` on this branch: BUILD SUCCESS, 53 tests, 0 failures (17 in `GoogleCloudStorageConsumerDownloadPathTest`, 21 in `GoogleCloudStorageFileNameHelperTest`). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
