oscerd opened a new pull request, #25093:
URL: https://github.com/apache/camel/pull/25093
## What
Completes the secret-redaction coverage of the Camel JBang MCP server's
opt-in security layer (added in CAMEL-24218). Redaction previously only
inspected `String` tool results, so tools returning a `JsonObject` bypassed it
entirely, and the value regex could not match JSON-quoted values.
## Why
The runtime tools return `org.apache.camel.util.json.JsonObject`, not
`String`. `camel_runtime_properties` in particular dumps a running
application's configuration, which is exactly where a datasource password or an
API key surfaces. With redaction enabled, that output was still emitted
verbatim because the interceptor only redacted `String` results:
```java
if (config.isRedactionEnabled() && result instanceof String s) { ... }
```
Separately, the value regex (`[^\s,;}'"\]]+`) stops at a `"`, so it never
matched JSON-quoted values even for the cases it was meant to cover.
## Change
- `McpSecretRedactor.redactStructured(Object)` walks `Map`/`List` results in
place (`JsonObject` is a `LinkedHashMap`, `JsonArray` an `ArrayList`), blanks
the value of any entry whose key name denotes a secret (separator- and
case-insensitive, so `client-secret`, `client_secret` and `clientSecret` all
match), and runs the existing regex over string leaf values. The instance is
mutated in place, so a tool's declared return type is preserved.
- Strengthened `DEFAULT_PATTERNS`: `client_secret`, secrets carried as a URL
query parameter (`jdbc:...?password=`, which has no userinfo `@` and so was
missed by the connection-string rule), PEM private-key blocks, and `passphrase`.
- `McpSecurityInterceptor` now routes `Map`/`List` results through
`redactStructured` and keeps the regex path for `String`.
- Tests: 7 new cases in `McpSecretRedactorTest`, including the
previously-missed `JsonObject` with a `datasource.password` key, nested
`client-secret`, URL query-parameter and PEM cases, and a no-change assertion
for clean data.
Redaction stays opt-in and off by default; this only changes what happens
once an operator sets `camel.mcp.security.redaction.enabled=true`, so there is
no behavior change for the default configuration.
## Known follow-up
Plain record-returning tools (for example `ExampleFileResult.content`) are
still not redacted. Doing that type-safely needs either reflective record
rebuilding or a framework-level output filter once the Quarkus MCP server
exposes global guardrails (the interceptor already carries a TODO for that).
This PR deliberately covers the structured `JsonObject` path, which is where
live secrets actually surface.
## Scope note
Per the [Camel security
model](https://github.com/apache/camel/blob/main/docs/user-manual/modules/ROOT/pages/security-model.adoc),
the MCP server is a management surface whose network exposure is operator
responsibility, so this is hardening of an opt-in control rather than a
framework vulnerability fix. A separate, smaller item worth considering is that
`camel mcp --http` binds `0.0.0.0` by default rather than loopback; that is not
addressed here.
## Testing
```
Tests run: 35, Failures: 0, Errors: 0
(McpSecretRedactorTest, McpSecurityInterceptorTest, McpSecurityConfigTest,
McpAccessFilterTest)
```
Formatted with `mvn formatter:format impsort:sort`.
## Attribution
_Claude Code on behalf of Andrea Cosentino (@oscerd)._ No JIRA was filed for
this change; happy to add a `CAMEL-XXXX` reference and rename the branch/commit
if you would prefer to track it in JIRA.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
