[backport camel-4.18.x] CAMEL-24548 CAMEL-24549: Harden cloud storage download containment

[davsclaus]

Backport of #25873

Adaptation of #25873 onto camel-4.18.x.

Original PR: #25873 - CAMEL-24548 CAMEL-24549: Harden cloud storage download containment
Original author: @oscerd
Target branch: camel-4.18.x

Original description

This hardens local download path containment in the Azure Blob/DataLake and Google Storage components by resolving existing filesystem path segments before accepting a destination. It preserves valid nested paths while rejecting linked paths that resolve beyond the configured directory.

JIRA:

• https://issues.apache.org/jira/browse/CAMEL-24548
• https://issues.apache.org/jira/browse/CAMEL-24549

Note on this backport

Not a mechanical cherry-pick. camel-4.18.x predates the shared camel-azure-common module and
AzureFileNameHelper introduced later — this module doesn't exist at all on this branch. Each Azure
component instead has its own duplicated private resolveWithinDirectory() method
(BlobOperations and DataLakeFileOperations), matching the pre-fix logic on main exactly. The same
hardening (resolve existing path segments via Files.exists(..., NOFOLLOW_LINKS) + toRealPath()
before the containment check) was applied directly to both duplicated methods, with equivalent new
tests added to BlobOperationsTest and DataLakeFileOperationTest (via the public
downloadBlobToFile/downloadToFile entry points, since there's no shared helper class to unit-test
directly here).

The Google fix is a direct, unmodified port: GoogleCloudStorageFileNameHelper on this branch is
identical to its pre-fix state on main.

As with the camel-4.22.x backport (#25990), the upgrade-guide entry was added to the existing
"Upgrading from 4.18.4 to 4.18.5" section of camel-4x-upgrade-guide-4_18.adoc, since
camel-4x-upgrade-guide-4_23.adoc doesn't exist on this branch.

Verification on this branch:

• BlobOperationsTest: 6 passed (incl. new symlink-containment test)
• DataLakeFileOperationTest: 5 passed (incl. new symlink-containment test)
• GoogleCloudStorageFileNameHelperTest: 10 passed
• Full unit suites for all three modules: 33 + 16 + 30 tests, 0 failures

Given the manual adaptation, this should go through a normal review rather than the no-review
backport fast path.

Claude Code on behalf of davsclaus

[gnodet]

Adapted backport of PR #25873 to camel-4.18.x — the security fix (path traversal via symlink resolution) is correctly adapted. The resolveExistingPathSegments logic is identical across all inlined locations and matches the original shared utility class. CI is green.

Minor observations (informational, not blocking):

1. Test coverage gap: The backport tests for BlobOperations and DataLakeFileOperations only cover the basic symlink case but not the parent-segment-after-symlink case (link/../file.txt) that the original AzureFileNameHelperTest covers. The logic is identical to GoogleCloudStorageFileNameHelper which does cover both cases, so this is a minor test coverage gap, not a security gap.

2. Upgrade guide on main: Per the project's backport upgrade-guide policy, this entry should also be added to camel-4x-upgrade-guide-4_18.adoc on main — either as part of this workflow or in a follow-up doc-sync PR.

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of Guillaume Nodet