oscerd opened a new pull request, #25847: URL: https://github.com/apache/camel/pull/25847
Fixes [CAMEL-24438](https://issues.apache.org/jira/browse/CAMEL-24438). With camel.server.staticEnabled=true, setupStatic() mounts a catch-all at staticContextPath (default "/") and resolves each request against the process working directory first, then staticSourceDir, then the classpath root and META-INF/resources/. Nothing filtered by file type, so anything reachable that way was served - and a camel-main or camel-jbang deployment keeps application.properties, its route sources and every other classpath resource in exactly those locations. GET /application.properties returned the operator's secrets, unauthenticated. staticSourceDir cannot be turned into a jail: its own javadoc calls it an "Additional directory that holds static content", so the working directory and the classpath are the primary locations by design, not a fallback. Instead restrict what may be served to what the option is documented to host - staticEnabled says it lets Camel "host html/js and other web files". New camel.server.staticFileExtensions option, defaulting to the web assets: html,htm,css,js,mjs,map,json,txt,xml,svg,png,jpg,jpeg,gif,ico,webp,woff,woff2,ttf, eot,otf,pdf,wasm A request whose file name has no extension, or an extension outside the list, is answered with 404 before any lookup happens. Setting the option to an empty value restores the unrestricted behaviour. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> ## Verification Full `mvn clean install -DskipTests` green across the reactor; generated files regenerated and committed. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
