This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 5bdc207798f4 CAMEL-24222: camel-jbang-mcp - catalog-based scheme
detection in dependency audit (follow-up) (#25168)
5bdc207798f4 is described below
commit 5bdc207798f4e94b26d024f42686339eb69df296
Author: Andrea Cosentino <[email protected]>
AuthorDate: Tue Jul 28 09:26:37 2026 +0200
CAMEL-24222: camel-jbang-mcp - catalog-based scheme detection in dependency
audit (follow-up) (#25168)
CAMEL-24222: align scheme detection with the catalog and strengthen
reachability tests
Addresses the remaining gnodet/davsclaus review points:
- extractUsedSchemes now walks the known catalog component names and matches
them the same way DependencyCheckTools/HardenTools do, instead of
tokenizing
the route text. Tokenizing treated the DSL's own structural keywords
(from:, to:, steps:, uri:) as component schemes, producing false
positives.
- The reachability test now asserts camel-http is actually flagged reachable
when a route uses it, and a new negative test asserts it is NOT reachable
when no route uses it. The previous assertion (>= 0) could never fail.
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>
---
.../commands/mcp/DependencySecurityAuditTools.java | 23 ++++++++++++++-------
.../mcp/DependencySecurityAuditToolsTest.java | 24 +++++++++++++++++++++-
2 files changed, 39 insertions(+), 8 deletions(-)
diff --git
a/dsl/camel-jbang/camel-jbang-mcp/src/main/java/org/apache/camel/dsl/jbang/core/commands/mcp/DependencySecurityAuditTools.java
b/dsl/camel-jbang/camel-jbang-mcp/src/main/java/org/apache/camel/dsl/jbang/core/commands/mcp/DependencySecurityAuditTools.java
index a7072a1bfdcf..f482d0419992 100644
---
a/dsl/camel-jbang/camel-jbang-mcp/src/main/java/org/apache/camel/dsl/jbang/core/commands/mcp/DependencySecurityAuditTools.java
+++
b/dsl/camel-jbang/camel-jbang-mcp/src/main/java/org/apache/camel/dsl/jbang/core/commands/mcp/DependencySecurityAuditTools.java
@@ -77,7 +77,7 @@ public class DependencySecurityAuditTools {
List<SecurityAdvisoryModel> allAdvisories =
advisoryService.advisories();
List<String> usedSchemes = routes != null && !routes.isBlank()
- ? extractUsedSchemes(routes) : List.of();
+ ? extractUsedSchemes(routes, catalog) : List.of();
Map<String, ArtifactAudit> auditByArtifact = new LinkedHashMap<>();
@@ -159,19 +159,28 @@ public class DependencySecurityAuditTools {
}
}
- private List<String> extractUsedSchemes(String routes) {
+ /**
+ * Detect which components a route uses by walking the known catalog
component names, the same way
+ * {@link DependencyCheckTools} and {@code HardenTools} do. Tokenizing the
route text instead would treat the DSL's
+ * own structural keywords ({@code from:}, {@code to:}, {@code steps:},
{@code uri:}) as component schemes.
+ */
+ private List<String> extractUsedSchemes(String routes, CamelCatalog
catalog) {
List<String> schemes = new ArrayList<>();
String lower = routes.toLowerCase();
- for (String token : lower.split("[^a-z0-9-]+")) {
- if (token.length() > 2 && lower.contains(token + ":")) {
- if (!schemes.contains(token)) {
- schemes.add(token);
- }
+ for (String comp : catalog.findComponentNames()) {
+ if (containsComponent(lower, comp) && !schemes.contains(comp)) {
+ schemes.add(comp);
}
}
return schemes;
}
+ private boolean containsComponent(String content, String comp) {
+ return content.contains(comp + ":")
+ || content.contains("\"" + comp + "\"")
+ || content.contains("'" + comp + "'");
+ }
+
private boolean isReachable(String artifactId, List<String> usedSchemes,
CamelCatalog catalog) {
if (usedSchemes.isEmpty()) {
return true;
diff --git
a/dsl/camel-jbang/camel-jbang-mcp/src/test/java/org/apache/camel/dsl/jbang/core/commands/mcp/DependencySecurityAuditToolsTest.java
b/dsl/camel-jbang/camel-jbang-mcp/src/test/java/org/apache/camel/dsl/jbang/core/commands/mcp/DependencySecurityAuditToolsTest.java
index cdada746be44..186958df6dd1 100644
---
a/dsl/camel-jbang/camel-jbang-mcp/src/test/java/org/apache/camel/dsl/jbang/core/commands/mcp/DependencySecurityAuditToolsTest.java
+++
b/dsl/camel-jbang/camel-jbang-mcp/src/test/java/org/apache/camel/dsl/jbang/core/commands/mcp/DependencySecurityAuditToolsTest.java
@@ -98,6 +98,8 @@ class DependencySecurityAuditToolsTest {
@Test
void shouldIncludeReachabilityWhenRoutesProvided() {
+ // The route uses the http component and the POM declares vulnerable
camel-http at 4.10.0, so the audit
+ // must flag camel-http as reachable.
String routes = "from: \"http:example.com\"\nsteps:\n - to:
\"log:out\"";
DependencySecurityAuditTools.AuditResult result
= tools.camel_dependency_security_audit(SIMPLE_POM, routes,
null, null, null, null);
@@ -105,7 +107,27 @@ class DependencySecurityAuditToolsTest {
assertThat(result).isNotNull();
assertThat(result.summary()).isNotNull();
assertThat(result.summary().totalDependencies()).isGreaterThan(0);
-
assertThat(result.summary().reachableVulnerableArtifacts()).isGreaterThanOrEqualTo(0);
+
assertThat(result.summary().reachableVulnerableArtifacts()).isGreaterThan(0);
+ assertThat(result.vulnerableArtifacts())
+ .anySatisfy(a -> {
+ assertThat(a.artifactId()).isEqualTo("camel-http");
+ assertThat(a.reachable()).isTrue();
+ });
+ }
+
+ @Test
+ void shouldNotFlagReachabilityWhenRoutesUseOtherComponents() {
+ // camel-http is declared and vulnerable, but no route uses it, so it
must NOT be reported as reachable.
+ String routes = "from: \"timer:tick\"\nsteps:\n - to: \"log:out\"";
+ DependencySecurityAuditTools.AuditResult result
+ = tools.camel_dependency_security_audit(SIMPLE_POM, routes,
null, null, null, null);
+
+ assertThat(result).isNotNull();
+ assertThat(result.summary().reachableVulnerableArtifacts()).isZero();
+ assertThat(result.vulnerableArtifacts())
+ .filteredOn(a -> a.artifactId().equals("camel-http"))
+ .singleElement()
+ .satisfies(a -> assertThat(a.reachable()).isFalse());
}
@Test
