oscerd opened a new pull request, #25590: URL: https://github.com/apache/camel/pull/25590
Backport of #25587 to `camel-4.14.x`. ## Description `RedisConfiguration.createDefaultSerializer()` builds a bare `JdkSerializationRedisSerializer`, whose read path runs through Spring's `ConfigurableObjectInputStream` with no `ObjectInputFilter` installed. Every other component in the codebase that performs JDK deserialization resolves a filter first — `camel-spring-redis` was the one path left without one. Adds a `deserializationFilter` endpoint option (`advanced,security`). The default serializer now installs a filter: the configured pattern when set, otherwise the JVM-wide `jdk.serialFilter`, otherwise a conservative default allow-list. This covers the consumer, the producer read commands, and `SpringRedisIdempotentRepository`, which all share the default serializer. ## Differences from the main PR `DeserializationFilterHelper` does not exist on this branch, so `FilteringDeserializer` carries its own `DEFAULT_DESERIALIZATION_FILTER` constant and a local `resolveDeserializationFilter`, following the pattern already used here by `NettyHttpHelper`, `JmsBinding` and `MinaConverter`. As on those classes, the constant is `!java.net.**;java.**;javax.**;org.apache.camel.**;!*` without the JEP-290 graph-shape limits, which are main-only (CAMEL-23609) — the upgrade-guide wording reflects that. The upgrade-guide entry goes in `camel-4x-upgrade-guide-4_14.adoc`. Verified that `JdkSerializationRedisSerializer(Converter, Converter)`, `ConfigurableObjectInputStream(InputStream, ClassLoader)` and `Deserializer.deserialize` are identical on the Spring 6.2 / Spring Data 3.5 used here, so the code compiles the same way as on main. ## Testing `123/123` module tests pass, including the 5 new ones. Note: this branch has ~144 generated files carrying a stale `4.14.9-SNAPSHOT` version string that any local build rewrites to `4.14.10-SNAPSHOT`. That drift is pre-existing and unrelated to this change, so it is deliberately not included here. --- **Do not merge before #25587.** --- _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
