oscerd opened a new pull request, #740:
URL: https://github.com/apache/camel-karaf/pull/740
Fixes #732
## What
`ServletExporter` registered the CXF transport servlet with:
```java
whiteboardProps.put("servlet.init.hide-service-list-page",
getProp(properties, CXF_SERVLET_PREFIX + "hide-service-list-page",
"false")); // :76-77
...
whiteboardProps.put("servlet.init.service-list-page-authenticate",
getProp(properties, CXF_SERVLET_PREFIX +
"service-list-page-authenticate", "false")); // :94-95
```
`HTTPTransportActivator` registers the `ManagedService`, so with no
`org.apache.cxf.osgi` configuration these defaults apply as-is — including
on the
`updated(null)` path (`:61-63`), which is the shape a default install
actually
takes. Installing the feature therefore published an enumerable,
unauthenticated
listing of every CXF endpoint in the container at `/cxf`, with no
configuration
step needed to turn it on.
## How
`hide-service-list-page` now defaults to `"true"`, making the listing opt-in.
I left `service-list-page-authenticate` alone: once the page is hidden by
default, turning it on is a deliberate act, and the authentication realm
already
defaults to `karaf` for an operator who wants both. Flipping two defaults at
once would make the opt-in path harder to reason about.
An operator who wants the page back sets, in the `org.apache.cxf.osgi` PID:
```
org.apache.cxf.servlet.hide-service-list-page=false
org.apache.cxf.servlet.service-list-page-authenticate=true # optional
```
which is recorded in a comment at the call site.
## Tests
`ServletExporterTest` captures the whiteboard properties handed to
`registerService` and asserts:
- the default is `"true"` for an empty config
- **and on the `updated(null)` path** — that is the one a default install
exercises, and it was a separate code path
- an explicit `hide-service-list-page=false` is still honoured, so the opt-in
works
- the surrounding defaults (`disable-address-updates`,
`service-list-page-authenticate-realm`, `use-x-forwarded-headers`, the
servlet
pattern) are unchanged
```
Tests run: 4, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
```
The module had no test sources, so this adds the `junit-jupiter` and
`mockito`
test dependencies.
## Notes
- These values match historic upstream CXF defaults. CXF 4.x ships no OSGi
transport module, so this glue is maintained here now and the default is
ours
to choose.
- Each endpoint's `?wsdl` is reachable without authentication regardless, so
this
removes a discovery convenience rather than closing a disclosure channel —
which is why it is a default change rather than a fix to the servlet
itself.
- **This is visible behaviour for anyone relying on the page and wants a
release
note.** #732 also asked for the PID to be documented in the camel-cxf
feature
docs; `docs/modules/ROOT/pages/components.adoc` is currently just a
pointer to
`camel-features.xml` with no per-component pages, so there is no natural
place
for it yet — the call-site comment carries it yet.
---
_Claude Code on behalf of Andrea Cosentino_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
