Croway opened a new pull request, #197:
URL: https://github.com/apache/camel-spring-boot-examples/pull/197

   ## Summary
   
   - Camel 4.23 hardened the `file:` component's `jailStartingDirectory` 
containment check (`GenericFileHelper.isWithinDirectory`) to unconditionally 
reject any starting directory whose compacted path still begins with `..`. This 
is always true for the upload backend's `file:../client` endpoint, so every 
upload request in the `http-streaming` example started throwing 
`IllegalArgumentException` (the download scenario was unaffected since it reads 
via plain `java.io.File`, bypassing the file producer entirely).
   - Fix: add `jailStartingDirectory=false` to the upload endpoint. This is 
safe here because the written file name (`output`) is a hardcoded constant, 
never derived from exchange/header data, so there's nothing for the containment 
check to actually protect against.
   - Document the change and the security trade-off in 
`http-streaming/README.adoc`, with an explicit warning against reusing 
`jailStartingDirectory=false` in routes where the file name or directory come 
from exchange/header/external input.
   
   ## Test plan
   
   - [x] `mvn -q -o compile` on `http-streaming/upload/backend-server`
   - [x] Started the backend server and uploaded a 5MB file via `curl -X PUT -F 
"data=@input" .../test`; verified the written `output` file is byte-identical 
to the input (previously failed with `IllegalArgumentException`)
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   
   https://claude.ai/code/session_01R7ZfDGqU16yJFWuGogJ3Ju


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to