Croway opened a new pull request, #197: URL: https://github.com/apache/camel-spring-boot-examples/pull/197
## Summary - Camel 4.23 hardened the `file:` component's `jailStartingDirectory` containment check (`GenericFileHelper.isWithinDirectory`) to unconditionally reject any starting directory whose compacted path still begins with `..`. This is always true for the upload backend's `file:../client` endpoint, so every upload request in the `http-streaming` example started throwing `IllegalArgumentException` (the download scenario was unaffected since it reads via plain `java.io.File`, bypassing the file producer entirely). - Fix: add `jailStartingDirectory=false` to the upload endpoint. This is safe here because the written file name (`output`) is a hardcoded constant, never derived from exchange/header data, so there's nothing for the containment check to actually protect against. - Document the change and the security trade-off in `http-streaming/README.adoc`, with an explicit warning against reusing `jailStartingDirectory=false` in routes where the file name or directory come from exchange/header/external input. ## Test plan - [x] `mvn -q -o compile` on `http-streaming/upload/backend-server` - [x] Started the backend server and uploaded a 5MB file via `curl -X PUT -F "data=@input" .../test`; verified the written `output` file is byte-identical to the input (previously failed with `IllegalArgumentException`) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01R7ZfDGqU16yJFWuGogJ3Ju -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
