oscerd opened a new issue, #157: URL: https://github.com/apache/camel-kit/issues/157
Tracking issue for verification item **V5** of the Camel-Kit security model (apache/camel-kit#6, part of the acceptance of #5), from maintainer answers Q7 and Q9. **Claims it verifies.** §4.8 P3: `init` writes stay inside the operator-selected target. §4.8 P4: every archive extraction stays inside its cache directory. **Work.** Verify with tests that `init` does not follow a symbolic link planted in an untrusted tree to write outside the target (a generated subtree replaced by a symlink), and that the Citrus schema, Forage catalog and Knowledge index extractions confine entries to their cache or staging directory (zip-slip, absolute entries, symlink entries). **Interim triage** while open: a redirected write or an extraction escape reachable from an untrusted tree or a downloaded artifact is `VALID`. **Done when** the tests exist and pass in CI, and §4.14.2 and the YAML sidecar mark V5 verified. _AI-generated by Claude Code (Claude Fable 5.1) on behalf of @oscerd._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
