[CAMEL-13042] camel-core - File producer should by default not allow writing files to directories outside its starting directory

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.23.0
• Fix Version/s: 2.21.5, 2.22.3, 2.23.1, 2.24.0, 3.0.0
• Component/s: camel-core
• Estimated Complexity: Unknown
• Assignee: Claus Ibsen
• Reporter: Claus Ibsen
• Created: 08/Jan/19 12:13
• Updated: 17/Oct/22 09:24
• Resolved: 09/Jan/19 09:42

Description

For example

<from uri="file:src/test/resources/data?noop=true"/>
<setHeader headerName="CamelFileName">
    <simple>../../${file:name}</simple>
</setHeader>
<to uri="file:target/results"/>

Can write the file outside the target/results folder. We should not allow this by default to be more security friendly.

We should add a new option (maybe name it jailStartingDirectory or allowWriteOutsideStartingDirectory) or some better name

Issue Links

• is related to: CAMEL-18616 camel-file - Add option to jail starting directory
• links to: GitHub Pull Request #2700