gnodet-bot commented on code in PR #26737:
URL: https://github.com/apache/camel/pull/26737#discussion_r4070627545


##########
docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc:
##########
@@ -714,6 +714,13 @@ It is unset by default, which keeps the previous behaviour 
of accepting any path
 Additionally, a local input path that does not exist is now reported as a 
`File not found` `IOException`
 before Docling is invoked. Previously the size check silently skipped a path 
that resolved to nothing and
 the failure surfaced later, from the Docling process or API call.
+
+The `CamelDoclingOutputFilePath` header, which selects the CLI output 
directory, is now normalized before it
+is passed to Docling, and a new `outputBaseDirectory` option confines it the 
same way `inputBaseDirectory`
+confines input paths. Both are unset by default, which keeps the previous 
behaviour of using the header value
+as given. When `outputBaseDirectory` is set, an output path that resolves 
outside it - including an absolute

Review Comment:
   ⚠️ **Inaccurate:** normalization is applied unconditionally — when 
`outputBaseDirectory` is unset _and_ the header is set, 
`resolveWithinOutputBaseDirectory` still calls 
`Paths.get(outputPath).normalize()`. The raw header value is no longer passed 
verbatim. Only the jail check is gated behind the option; the normalization 
step runs regardless.
   
   Suggestion:
   
   ```suggestion
   confines input paths. Both are unset by default; when `outputBaseDirectory` 
is absent the header value is
   normalized (lexically — `..` components are resolved) but otherwise used as 
given.
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to