oscerd opened a new issue, #9058:
URL: https://github.com/apache/camel-quarkus/issues/9058
`extensions-jvm/diagram/.../CamelDiagramRecorder.java:66-104`
This route is dev-mode only — `DiagramProcessor` is `@BuildSteps(onlyIf =
IsDevelopment.class)` — so this is a consistency cleanup rather than a
production concern. Three things diverge from how the equivalent dev-console
bridge behaves:
1. **Console selection is not restricted to the diagram console.** The `:id`
path param is resolved against every entry in the registry:
```java
DevConsole console = devConsoleRegistry.stream()
.filter(c -> c.getId().equals(id))
.findFirst().orElse(null);
```
2. **Options are copied verbatim with no allowlist**, unlike
`CamelCoreDevUIService.sanitizeOptions`, which strips unknown keys:
```java
ctx.queryParams().forEach(entry -> options.put(entry.getKey(),
entry.getValue()));
```
3. **TEXT output is served as `text/html` without encoding** when
`format=html`:
```java
String contentType = wantsHtml ? "text/html" : "text/plain";
ctx.response().putHeader("Content-Type",
contentType).end(result.toString());
```
**Suggested fix**
Restrict console selection to the diagram console id, pass options through
an allowlist equivalent to `sanitizeOptions`, and HTML-encode the body when
serving it as `text/html`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
