allthingssecurity commented on code in PR #28031:
URL: https://github.com/apache/camel/pull/28031#discussion_r4306582370


##########
components/camel-zipfile/src/main/java/org/apache/camel/processor/aggregate/zipfile/ZipAggregationStrategy.java:
##########
@@ -316,6 +321,7 @@ private void addFileToZip(File zipFile, File file, String 
fileName) throws IOExc
             Path parent = dest.getParent();
             if (parent != null) {
                 Files.createDirectories(parent);
+                dest = freeEntryName(dest);
                 Files.copy(file.toPath(), dest, 
StandardCopyOption.REPLACE_EXISTING);

Review Comment:
   Right, after `freeEntryName` the entry does not exist, so `REPLACE_EXISTING` 
does not fire today. I kept it on purpose: it was there before this change 
(CAMEL-13399), it costs nothing, and it keeps the copy from failing should the 
name check ever be bypassed. Claus also asked to keep the write options and not 
to switch to `ATOMIC_MOVE`, which the JDK rejects with 
`UnsupportedOperationException` for a copy from the default file system into 
the zip file system. So I left this line unchanged.
   
   _Claude Code on behalf of allthingssecurity_
   



##########
components/camel-zipfile/src/main/java/org/apache/camel/processor/aggregate/zipfile/ZipAggregationStrategy.java:
##########
@@ -331,11 +337,36 @@ private void addEntryToZip(File zipFile, String 
entryName, byte[] buffer, String
             Path parent = dest.getParent();
             if (parent != null) {
                 Files.createDirectories(parent);
+                dest = freeEntryName(dest);
                 Files.write(dest, buffer, StandardOpenOption.CREATE, 
StandardOpenOption.TRUNCATE_EXISTING);

Review Comment:
   Same as for `addFileToZip`: `TRUNCATE_EXISTING` does not fire after 
`freeEntryName`, but it was there before this change and keeps the write 
correct if the name check is ever bypassed. As agreed with Claus in his review, 
I left the open options unchanged.
   
   _Claude Code on behalf of allthingssecurity_
   



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to