[
https://issues.apache.org/jira/browse/CAMEL-26398?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18134152#comment-18134152
]
Federico Mariani commented on CAMEL-26398:
------------------------------------------
Agreed, thanks. The first fix item went too far: deriving the directory from an
absolute file's parent would let a call read any file on the disk. Revised:
* An absolute {{file}} is accepted only when it lies inside the given
{{directory}} (resolved with {{toRealPath()}}, so symlinks count); it is then
made relative. Anything else is refused, as today.
* No {{directory}}: still refused, but the message names what to pass. If the
client sends exactly one MCP root, that root can be the default, and the same
containment rule applies to it.
* {{camel_write_file}} creates a missing {{directory}} only inside an existing
project directory, under the same rule.
I'll update the Fix section of the description accordingly.
> camel-jbang-mcp - the file tools refuse an absolute file path, a call without
> directory, and a directory that does not exist yet
> --------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26398
> URL: https://issues.apache.org/jira/browse/CAMEL-26398
> Project: Camel
> Issue Type: Improvement
> Components: camel-jbang, camel-jbang-mcp
> Affects Versions: 4.23.0
> Reporter: Federico Mariani
> Assignee: Federico Mariani
> Priority: Major
>
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
