This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-kamelets.git
The following commit(s) were added to refs/heads/main by this push:
new 29487da84 Fix #2973: strip the remaining destination-affecting HTTP
headers in the http sinks (#2976)
29487da84 is described below
commit 29487da8435aaa24b6e94a09a12abcafacdfc220
Author: Andrea Cosentino <[email protected]>
AuthorDate: Mon Aug 24 18:42:17 2026 +0200
Fix #2973: strip the remaining destination-affecting HTTP headers in the
http sinks (#2976)
http-sink and http-secured-sink removed CamelHttpUri before dispatch but
left CamelHttpPath, CamelHttpQuery, CamelHttpRawQuery, CamelRestHttpUri and
CamelRestHttpQuery in place. camel-http builds the request URI from those,
so an inbound header still altered the operator-configured destination.
Verified against a local listener: with the wire headers set, the original
template sent to /intended/hijacked?injected=1 where the operator had
configured /intended. After the change it sends to /intended.
Strip the destination-affecting headers by name rather than with a
CamelHttp* pattern: the pattern would also drop CamelHttpCharacterEncoding
and CamelHttpProtocolVersion, which are legitimate, while still missing the
CamelRestHttp* pair.
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
kamelets/http-secured-sink.kamelet.yaml | 10 ++++++++++
kamelets/http-sink.kamelet.yaml | 10 ++++++++++
2 files changed, 20 insertions(+)
diff --git a/kamelets/http-secured-sink.kamelet.yaml
b/kamelets/http-secured-sink.kamelet.yaml
index 92a73b783..c6eb2edc9 100644
--- a/kamelets/http-secured-sink.kamelet.yaml
+++ b/kamelets/http-secured-sink.kamelet.yaml
@@ -105,6 +105,16 @@ spec:
steps:
- removeHeader:
name: CamelHttpUri
+ - removeHeader:
+ name: CamelHttpPath
+ - removeHeader:
+ name: CamelHttpQuery
+ - removeHeader:
+ name: CamelHttpRawQuery
+ - removeHeader:
+ name: CamelRestHttpUri
+ - removeHeader:
+ name: CamelRestHttpQuery
- setHeader:
name: CamelHttpMethod
constant: "{{method}}"
diff --git a/kamelets/http-sink.kamelet.yaml b/kamelets/http-sink.kamelet.yaml
index 1d272a58a..5e3be9768 100644
--- a/kamelets/http-sink.kamelet.yaml
+++ b/kamelets/http-sink.kamelet.yaml
@@ -57,6 +57,16 @@ spec:
steps:
- removeHeader:
name: CamelHttpUri
+ - removeHeader:
+ name: CamelHttpPath
+ - removeHeader:
+ name: CamelHttpQuery
+ - removeHeader:
+ name: CamelHttpRawQuery
+ - removeHeader:
+ name: CamelRestHttpUri
+ - removeHeader:
+ name: CamelRestHttpQuery
- setHeader:
name: CamelHttpMethod
constant: "{{method}}"
