oscerd opened a new pull request, #25744: URL: https://github.com/apache/camel/pull/25744
## Backport of #25596 Cherry-pick of #25596 onto `camel-4.18.x`. **Original PR:** #25596 **Target branch:** `camel-4.18.x` ### What changed `DoclingProducer.getInputPath()` decided what a `String` message body *meant* by inspecting its prefix: `http://` / `https://` was handed to Docling as a remote URL to fetch, a leading `/` or an embedded `\` was read from the local filesystem, anything else was converted as document content. The mode was chosen implicitly and the route author had no way to influence it. The two location readings are now opt-in: | Option | Default | Effect when enabled | |---|---|---| | `allowUrlSource` | `false` | A body starting with `http://` / `https://` is fetched as a URL | | `allowFilePathSource` | `false` | A body starting with `/`, or containing `\`, is read from disk | | `inputBaseDirectory` | _(unset)_ | Local input paths must resolve inside this directory | Only a bare `String` body is gated, because only it is ambiguous. The `CamelDoclingInputFilePath` header, `File` / `byte[]` / `InputStream` bodies and the explicit path collections used by the batch operations keep working with no opt-in. Also renames `validateFileSize` to `validateFileSizeIfPresent` (it was wrapped in `Files.exists()` and so silently skipped a path that resolved to nothing), adds `validateLocalInputPath` which requires the path to exist, and collapses the duplicated `http://` / `https://` prefix tests into a single `isRemoteSource()` helper. ### :warning: This backport is adapted, not a mechanical replay `camel-4.18.x` has diverged from `main` in four ways that required hand-resolution. Please review accordingly: 1. **The chunking operations do not exist on this branch.** `processChunkHybrid`, `processChunkHierarchical` and `addSourceToChunkRequest` are absent, so the corresponding `isRemoteSource()` call site has nothing to apply to. That block was **dropped** rather than introduced — backporting it would have added a feature under a fix. 2. **Older temp-file handling kept.** This branch still uses `Files.createTempFile` + `registerTempFileCleanup` rather than `createSecureTempDir` / `registerTempDirCleanup`. The branch's own handling is preserved; only the method rename is taken. 3. **`SecurityUtils` is main-only.** The security-marker registry does not exist on this branch, so that file is **not** part of the backport. 4. **`@UriParam` has no `security` attribute here.** `security = "insecure:dev"` was stripped, leaving `@UriParam(label = "security")`. The options behave identically; they are simply not registered with a framework that does not exist on this branch. No upgrade-guide edit is included — guide notes for every release line live on `main`, and the 4.18.5 note will be added there separately. ### Verification - Full reactor `mvn clean install -DskipTests`: **BUILD SUCCESS, 657/657**, `git status` clean afterwards (no regeneration drift). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
