Skip to content

[backport camel-4.18.x] CAMEL-24166: Enforce maxDecompressedSize in iterator/splitter mode for zip and tar - #26894

Merged
oscerd merged 1 commit into
apache:camel-4.18.xfrom
oscerd:backport/24817-to-camel-4.18.x
Sep 25, 2026
Merged

oscerd merged 1 commit into
apache:camel-4.18.xfrom
oscerd:backport/24817-to-camel-4.18.x

Conversation

@oscerd

@oscerd oscerd commented Sep 25, 2026

Copy link
Copy Markdown
Contributor

Backport of #24817

Cherry-pick of #24817 onto camel-4.18.x.

Original PR: #24817 - CAMEL-24166: Enforce maxDecompressedSize in iterator/splitter mode for zip and tar
Original author: @Croway
Target branch: camel-4.18.x

This is a straight cherry-pick of aa68003fabf3. It applied without conflicts, and its added and removed lines are identical to the original commit.

Behaviour change on 4.18.x: with usingIterator=true, or with ZipSplitter/TarSplitter, an entry that decompresses to more than maxDecompressedSize (default 1 GiB) now fails with an IOException, as it already does in the default single-entry mode. The 4.18.5 upgrade-guide note will be added on main, where the upgrade guides for all release lines are kept.

Testing on camel-4.18.x:

Claude Code on behalf of oscerd

🤖 Generated with Claude Code

…terator/splitter mode for zip and tar

(cherry picked from commit aa68003)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
@oscerd oscerd added backport indicate that a Pull request is a backport from a fix from the main branch bug Something isn't working labels Sep 25, 2026
@oscerd oscerd self-assigned this Sep 25, 2026
@oscerd oscerd added this to the 4.18.5 milestone Sep 25, 2026
@oscerd
oscerd merged commit 56ac052 into apache:camel-4.18.x Sep 25, 2026
3 checks passed
@oscerd
oscerd deleted the backport/24817-to-camel-4.18.x branch September 25, 2026 09:55

@gnodet-bot gnodet-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clean backport of #24817 (CAMEL-24166) — enforces maxDecompressedSize in iterator/splitter mode for both zip and tar components. Diff is identical to the original PR merged to main. Security fix with proper test coverage for both TarIterator/ZipIterator (via DataFormat) and TarSplitter/ZipSplitter paths. No issues.

This review was generated by an AI agent, Hermès on behalf of @gnodet.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport indicate that a Pull request is a backport from a fix from the main branch bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants