This is an automated email from the ASF dual-hosted git repository. gnodet pushed a commit to branch fix-sonarcloud-major-vulnerabilities-3-issues-1 in repository https://gitbox.apache.org/repos/asf/camel.git
commit cfcda1caf84dce8fee81af1d345370603bdf9519 Author: Guillaume Nodet <[email protected]> AuthorDate: Thu Jul 23 16:41:04 2026 +0200 (chores): fix SonarCloud MAJOR vulnerabilities (S6506, S5144) - Enforce HTTPS-only downloads with --proto '=https' in curl commands to prevent HTTP redirect attacks (S6506) - Suppress S5144 in AbstractExchange.evalPropertyValue() — exchange properties are set by trusted route authors; type conversion of exchange-internal values is intentional framework behavior per the Camel security model, not user-controlled URL construction Co-Authored-By: Claude Opus 4.6 <[email protected]> --- .github/actions/setup-llvm-mingw/install-llvm-mingw.sh | 2 +- .github/workflows/camel-launcher-native-exe.yml | 2 +- .../src/main/java/org/apache/camel/support/AbstractExchange.java | 5 ++++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/actions/setup-llvm-mingw/install-llvm-mingw.sh b/.github/actions/setup-llvm-mingw/install-llvm-mingw.sh index 8b0c8c465338..d9abdbf2ec7c 100755 --- a/.github/actions/setup-llvm-mingw/install-llvm-mingw.sh +++ b/.github/actions/setup-llvm-mingw/install-llvm-mingw.sh @@ -39,7 +39,7 @@ DEST="${INSTALL_DIR}/llvm-mingw-${VERSION}-ucrt-ubuntu-22.04-x86_64" if [ ! -x "${DEST}/bin/x86_64-w64-mingw32-clang" ]; then mkdir -p "$INSTALL_DIR" - curl -fsSL -o "${INSTALL_DIR}/${TARBALL}" \ + curl -fsSL --proto '=https' -o "${INSTALL_DIR}/${TARBALL}" \ "https://github.com/mstorsjo/llvm-mingw/releases/download/${VERSION}/${TARBALL}"; echo "${SHA256} ${INSTALL_DIR}/${TARBALL}" | sha256sum -c - tar -xf "${INSTALL_DIR}/${TARBALL}" -C "$INSTALL_DIR" diff --git a/.github/workflows/camel-launcher-native-exe.yml b/.github/workflows/camel-launcher-native-exe.yml index ea663f67bce4..b929a7b033dc 100644 --- a/.github/workflows/camel-launcher-native-exe.yml +++ b/.github/workflows/camel-launcher-native-exe.yml @@ -167,7 +167,7 @@ jobs: VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout -N) META="https://repository.apache.org/snapshots/org/apache/camel/camel-launcher/${VERSION}/maven-metadata.xml"; echo "Checking ${META}" - if ! curl -fsSL -o /dev/null "${META}"; then + if ! curl -fsSL --proto '=https' -o /dev/null "${META}"; then echo "ERROR: camel-launcher ${VERSION} is not on the Apache snapshot repository." echo "This job resolves the launcher's upstream modules from there (no -am build)." echo "Wait for a main-branch snapshot deploy of ${VERSION}, or rebuild with -am." diff --git a/core/camel-support/src/main/java/org/apache/camel/support/AbstractExchange.java b/core/camel-support/src/main/java/org/apache/camel/support/AbstractExchange.java index e14b699d37cb..10cc6ee63742 100644 --- a/core/camel-support/src/main/java/org/apache/camel/support/AbstractExchange.java +++ b/core/camel-support/src/main/java/org/apache/camel/support/AbstractExchange.java @@ -192,7 +192,10 @@ abstract class AbstractExchange implements Exchange, ExchangeExtension { return evalPropertyValue(type, value); } - @SuppressWarnings("unchecked") + // Suppressed S5144: exchange properties are set by trusted route authors — type conversion of + // exchange-internal values is intentional framework behavior, not user-controlled URL construction. + // See the Camel security model (docs/user-manual/modules/ROOT/pages/security-model.adoc). + @SuppressWarnings({ "unchecked", "java:S5144" }) private <T> T evalPropertyValue(final Class<T> type, final Object value) { if (value == null) { // let's avoid NullPointerException when converting to boolean for null values
