oscerd opened a new pull request, #23437:
URL: https://github.com/apache/camel/pull/23437
## Summary
Renames the Exchange header string values in `PdfHeaderConstants` from
non-Camel
prefixed values (`protection-policy`, `pdf-document`, `decryption-material`,
`files-to-merge`) to `CamelPdf<Name>`, following the convention used across
the rest of the Camel component catalog and matching the pattern established
in CAMEL-23526 (`camel-cxf`), CAMEL-23522 (`camel-mail`), CAMEL-23461
(`camel-aws-bedrock`), CAMEL-23532 (`camel-vertx-websocket` /
`camel-atmosphere-websocket` / `camel-iggy`), and CAMEL-23576 (`camel-jira`).
The Java field names (`PROTECTION_POLICY_HEADER_NAME`,
`PDF_DOCUMENT_HEADER_NAME`,
`DECRYPTION_MATERIAL_HEADER_NAME`, `FILES_TO_MERGE_HEADER_NAME`) are
unchanged
so routes referencing the constants symbolically continue to work; routes
using the literal string values must be updated (documented in the 4.21
upgrade guide).
## Why it matters
The previous header names (`protection-policy`, `pdf-document`,
`decryption-material`, `files-to-merge`) sit outside the `Camel*` namespace
that `DefaultHeaderFilterStrategy` filters at transport boundaries. The
`pdf-document` and `decryption-material` headers carry security-sensitive
PDFBox objects (`PDDocument`, `DecryptionMaterial`); `protection-policy`
carries the encryption settings used when writing the PDF. Untrusted
producers
upstream of a PDF processing route could previously inject these headers
without them being filtered, allowing an attacker who controls a transport
hop (HTTP, JMS, etc.) to swap in their own `PDDocument` or bypass encryption
expectations. Aligning the values with the `Camel*` namespace lets the
default header filter do its job.
## Generated artifacts
- `components/camel-pdf/.../pdf.json` (component catalog)
- `catalog/camel-catalog/.../components/pdf.json` (catalog mirror)
- `dsl/camel-endpointdsl/.../PdfEndpointBuilderFactory.java` — DSL header
accessors renamed (`protectionPolicy()` → `pdfProtectionPolicy()`,
`decryptionMaterial()` → `pdfDecryptionMaterial()`,
`filesToMerge()` → `pdfFilesToMerge()`; `pdfDocument()` keeps its name
but returns the new value `CamelPdfDocument`)
## Backports
`camel-pdf` exists on `camel-4.18.x` (identical source) and `camel-4.14.x`
(same constant values, slightly older Javadoc style). Backports are
straightforward and will be filed as follow-up PRs.
## Test plan
- [x] `mvn test` in `components/camel-pdf` — 10 tests pass
- [x] Build the module, catalog module and `camel-endpointdsl` from a clean
state, verify only `camel-pdf` regen artifacts appear in `git status`
- [x] Tests use symbolic constant references, so no test changes needed
- [x] Upgrade guide entry added under `=== camel-pdf`
Tracker: CAMEL-23577
_Reported by Claude Code on behalf of Andrea Cosentino_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
