oscerd opened a new pull request, #9068:
URL: https://github.com/apache/camel-quarkus/pull/9068
Fixes #9058.
`CamelDiagramHandler` resolved the `:id` path parameter against the entire
`DevConsoleRegistry`:
```java
DevConsole console = devConsoleRegistry.stream()
.filter(c -> c.getId().equals(id))
.findFirst()
.orElse(null);
```
so the route registered for diagrams rendered whatever console happened to
be registered. `camel-quarkus-diagram` depends on `camel-quarkus-console`, so
this is not hypothetical. Probing the integration test application against the
current code, every one of these answered `200` on `/q/camel/diagram/{id}`:
`bean`, `consumer`, `context`, `endpoint`, `gc`, `health`, `java-security`,
`jvm`, `log`
This restricts selection to `route-diagram`, `route-structure` and
`route-topology` — the three the Dev UI and the tests actually use — matching
the allowlist `CamelCoreDevUIService` already applies to the Dev UI JSON-RPC
bridge.
This is **dev mode only**: `DiagramProcessor` is `@BuildSteps(onlyIf =
IsDevelopment.class)`.
**Scope**
The issue also suggested allowlisting the query options and HTML-encoding
the output. Neither is included:
- **HTML encoding would break the feature.** `DiagramTest.routeDiagramHtml`
asserts the response contains `<html`; with `format=html` the diagram console
legitimately emits markup, so encoding it would render escaped tags as visible
text.
- **An options allowlist cannot be written safely from here.** The
`camel-route-diagram.js` and `camel-topology-diagram.js` components ship from
Camel core rather than this repository, so the set of parameters they send
cannot be enumerated, and guessing risks breaking the Dev UI.
**Tests**
`DiagramTest.nonDiagramConsoleIsNotReachable` is parameterised over
`context`, `jvm`, `health` and `java-security`. All four fail against the
previous behaviour (they returned `200`) and pass with this change. The four
existing cases are unchanged and still pass — 8/8 green.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
