oscerd opened a new pull request, #25788: URL: https://github.com/apache/camel/pull/25788
Fixes [CAMEL-24509](https://issues.apache.org/jira/browse/CAMEL-24509). Two related hardening items in camel-mina's object-codec path. ## 1. The exchange-holder unmarshal is not gated on `transferExchange` `MinaPayloadHelper.setIn()` / `setOut()` unmarshalled an inbound `DefaultExchangeHolder` whenever the decoded object happened to be one, with no check that the endpoint had enabled `transferExchange`: ```java public static void setIn(Exchange exchange, Object payload) { if (payload instanceof DefaultExchangeHolder) { DefaultExchangeHolder.unmarshal(exchange, (DefaultExchangeHolder) payload); ``` `DefaultExchangeHolder.unmarshal()` rebuilds the whole Exchange from the payload — exchange id, in body, in headers (via `setHeaders`, which replaces the map wholesale, including the `MINA_*` headers the consumer set moments earlier), the out message, and every property. The equivalent path in `JmsBinding` is gated behind `isObjectMessageEnabled()` and `checkDeserializedClass(payload)`. camel-mina had neither check. **This is defence in depth, not a reachable hole.** The object codec's accept-list refuses an arbitrary class when `objectCodecPattern` is unset, which is the default — verified against mina-core 2.2.4, where a `String` decodes but a `HashMap` or a `DefaultExchangeHolder` raises `ClassNotFoundException`. A holder only reaches the helper once an operator has widened that pattern. `setIn`/`setOut` gain endpoint-taking overloads and now gate on `transferExchange`; the previous two-argument ones are deprecated and no longer unmarshal. Only camel-mina used them. ## 2. `objectCodecPattern` was not marked security-relevant It widens the deserialization allow-list but carried no `security` marker, unlike `transferExchange` on the same configuration class. It is now `security = "insecure:serialization"` — which also registers it in `SecurityUtils`, so the policy framework can act on it — and its description warns that `*` accepts every loadable class from an untrusted peer and that leaving it unset is safest. Three historical upgrade guides (4.4, 4.8, 4.10) tell readers *"You can use `*` to accept all patterns"*. Those are release history and are left as-is; the fix is in the option users actually read. ## Testing `MinaExchangeHolderGateTest` covers the gate off, the gate on, and `setOut`. Verified RED against the ungated helper. `camel-mina` 104/104 (4 pre-existing skips) and a full `mvn clean install -DskipTests` across 700 modules. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
