oscerd opened a new pull request, #25054: URL: https://github.com/apache/camel/pull/25054
## What A codebase-driven refresh of the project [Security Model](https://github.com/apache/camel/blob/main/docs/user-manual/modules/ROOT/pages/security-model.adoc), reconciling it with the current `4.22.0-SNAPSHOT` tree. No new security commitment is introduced — every change corrects, grounds, or indexes something already in the ratified model (strict-superset rule). ## Why The model's last substantive change was #23503 (2026-05-25). Verifying its load-bearing claims against the code surfaced two factual drifts and one posture improvement worth reflecting, plus two rubric sections that were still thin. ## Changes **Factual corrections (code contradicts the doc):** - **Profile default.** The model stated Camel *"defaults to the `prod` profile"*. It does not: `DefaultConfigurationProperties.profile` is null by default and `ProfileConfigurer` applies no profile when unset, leaving the security policy at `warn`. Both `prod` (→ `fail`) and `dev` (→ relaxed) are explicit opt-ins. Corrected across the out-of-scope, disclaimed-properties and deployment-hardening sections; **`prod` remains the reference posture against which findings are judged.** - **Header-filter namespace.** Tightened the repeated *"`Camel*` / `org.apache.camel.*`"* wording to `Camel*` (matched case-insensitively). The `org.apache.camel.` prefix was deliberately removed in CAMEL-23543 (#23652) as a Camel 1.x artifact; the default `CAMEL_FILTER_STARTS_WITH` is `{"Camel","camel"}`. **Posture reflected:** - **CAMEL-23543 (Camel 4.21).** `DefaultHeaderFilterStrategy` now blocks the `Camel*` namespace by default, in both directions, for every consumer/producer — no per-component boilerplate. Updated the known-limitation and component-author guidance accordingly. **Rubric gaps filled:** - New **_Configuration variants that change the model_** section (profiles, security-policy levels, per-option opt-ins) consolidating the knobs that move the trust boundary. - New **machine-readable companion** `attachments/security-model.yaml` — a derived triage index (entry-point trust, in/out-of-scope families, config variants, claimed/disclaimed properties, known non-findings, dispositions). The prose page remains canonical. **Examples refreshed:** - Added the published 2026 CVE wave to the existing in-scope classes (deserialization, header/bean-dispatch, auth bypass, information disclosure, back-end query injection). **Every CVE ID was verified against the published advisory index** — no embargoed IDs. ## Notes for reviewers - Docs-only (AsciiDoc page + a static YAML attachment); no Java, generated files, or catalog impact. - Structural checks: all tables balanced, the YAML parses, no stale `org.apache.camel` filter claims remain. - The `prod`-as-reference-posture framing was chosen deliberately over modelling the literal no-profile default; happy to flip to the more literal framing if you prefer. --- _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
