This is an automated email from the ASF dual-hosted git repository.
Croway pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new dd2bf57190c1 CAMEL-24454: camel-mllp - default logPhi to false and
honour it on the paths that ignored it (#25832)
dd2bf57190c1 is described below
commit dd2bf57190c12ff7f1e97f121738867a680992ce
Author: Andrea Cosentino <[email protected]>
AuthorDate: Fri Aug 28 11:31:00 2026 +0200
CAMEL-24454: camel-mllp - default logPhi to false and honour it on the
paths that ignored it (#25832)
MllpComponent.logPhi defaulted to true, so message content reached the log
at the default
INFO/WARN levels with no configuration at all. For a protocol whose payload
is patient
data by definition, the safe default is the other way round.
Two paths logged content regardless of the flag, because MllpSocketBuffer
has no logPhi
of its own: the partial-payload warning in readFrom(), which logs the
content of a
legitimate in-flight message from a slow sender rather than only unexpected
bytes, and
the bytes-before-START_OF_BLOCK warning in readSocketInputStream(). Both
now go through a
helper that honours the setting, printing <PHI suppressed> when it is off.
The suppression is applied at the log statements, via a new
Hl7Util.convertToLoggableString, rather than inside
convertToPrintFriendlyString. That
method is not a logging helper despite the name:
generateAcknowledgementPayload() uses it
to extract the MSH-9 field, so redacting inside it corrupts the
acknowledgement rather
than the log - which is what the MLLP suite showed when it was tried that
way. Both
methods now carry a javadoc saying so.
LogPhiTest.testLogPhiDefault asserted that the default includes the
payload; it now
asserts the opposite. testLogPhiFalse and testLogPhiTrue are unchanged and
still pass, so
the flag still works in both directions - only the default moved.
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
.../org/apache/camel/catalog/components/mllp.json | 2 +-
.../org/apache/camel/component/mllp/mllp.json | 2 +-
.../apache/camel/component/mllp/MllpComponent.java | 4 +--
.../component/mllp/MllpTcpServerConsumer.java | 4 +--
.../camel/component/mllp/internal/Hl7Util.java | 30 ++++++++++++++++++++++
.../component/mllp/internal/MllpSocketBuffer.java | 16 ++++++++++--
.../mllp/internal/TcpSocketConsumerRunnable.java | 10 ++++----
.../apache/camel/component/mllp/LogPhiTest.java | 6 ++++-
.../camel/component/mllp/internal/Hl7UtilTest.java | 9 +++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_23.adoc | 17 ++++++++++++
10 files changed, 86 insertions(+), 14 deletions(-)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/mllp.json
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/mllp.json
index 1dcf8f84dc9c..b6b4035441c1 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/mllp.json
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/mllp.json
@@ -47,7 +47,7 @@
"tcpNoDelay": { "index": 20, "kind": "property", "displayName": "Tcp No
Delay", "group": "producer", "label": "advanced,producer", "required": false,
"type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true,
"configurationClass": "org.apache.camel.component.mllp.MllpConfiguration",
"configurationField": "configuration", "description": "Enable\/disable the
TCP_NODELAY socket option." },
"autowiredEnabled": { "index": 21, "kind": "property", "displayName":
"Autowired Enabled", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Whether autowiring is enabled. This is used for automatic autowiring options
(the option must be marked as autowired) by looking up in the registry to find
if there is a single instance of matching [...]
"defaultCharset": { "index": 22, "kind": "property", "displayName":
"Default Charset", "group": "advanced", "label": "advanced", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": "ISO-8859-1",
"description": "Set the default character set to use for byte to\/from String
conversions." },
- "logPhi": { "index": 23, "kind": "property", "displayName": "Log Phi",
"group": "advanced", "label": "advanced", "required": false, "type": "boolean",
"javaType": "java.lang.Boolean", "deprecated": false, "autowired": false,
"secret": false, "defaultValue": true, "description": "Whether to log PHI" },
+ "logPhi": { "index": 23, "kind": "property", "displayName": "Log Phi",
"group": "advanced", "label": "advanced", "required": false, "type": "boolean",
"javaType": "java.lang.Boolean", "deprecated": false, "autowired": false,
"secret": false, "defaultValue": false, "description": "Whether to log PHI" },
"logPhiMaxBytes": { "index": 24, "kind": "property", "displayName": "Log
Phi Max Bytes", "group": "advanced", "label": "advanced", "required": false,
"type": "integer", "javaType": "java.lang.Integer", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": 5120, "description": "Set
the maximum number of bytes of PHI that will be logged in a log entry." },
"maxBufferSize": { "index": 25, "kind": "property", "displayName": "Max
Buffer Size", "group": "advanced", "label": "advanced", "required": false,
"type": "integer", "javaType": "int", "deprecated": false, "autowired": false,
"secret": false, "defaultValue": 1073741824, "configurationClass":
"org.apache.camel.component.mllp.MllpConfiguration", "configurationField":
"configuration", "description": "Maximum buffer size used when receiving or
sending data over the wire." },
"minBufferSize": { "index": 26, "kind": "property", "displayName": "Min
Buffer Size", "group": "advanced", "label": "advanced", "required": false,
"type": "integer", "javaType": "int", "deprecated": false, "autowired": false,
"secret": false, "defaultValue": 2048, "configurationClass":
"org.apache.camel.component.mllp.MllpConfiguration", "configurationField":
"configuration", "description": "Minimum buffer size used when receiving or
sending data over the wire." },
diff --git
a/components/camel-mllp/src/generated/resources/META-INF/org/apache/camel/component/mllp/mllp.json
b/components/camel-mllp/src/generated/resources/META-INF/org/apache/camel/component/mllp/mllp.json
index 1dcf8f84dc9c..b6b4035441c1 100644
---
a/components/camel-mllp/src/generated/resources/META-INF/org/apache/camel/component/mllp/mllp.json
+++
b/components/camel-mllp/src/generated/resources/META-INF/org/apache/camel/component/mllp/mllp.json
@@ -47,7 +47,7 @@
"tcpNoDelay": { "index": 20, "kind": "property", "displayName": "Tcp No
Delay", "group": "producer", "label": "advanced,producer", "required": false,
"type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true,
"configurationClass": "org.apache.camel.component.mllp.MllpConfiguration",
"configurationField": "configuration", "description": "Enable\/disable the
TCP_NODELAY socket option." },
"autowiredEnabled": { "index": 21, "kind": "property", "displayName":
"Autowired Enabled", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Whether autowiring is enabled. This is used for automatic autowiring options
(the option must be marked as autowired) by looking up in the registry to find
if there is a single instance of matching [...]
"defaultCharset": { "index": 22, "kind": "property", "displayName":
"Default Charset", "group": "advanced", "label": "advanced", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": "ISO-8859-1",
"description": "Set the default character set to use for byte to\/from String
conversions." },
- "logPhi": { "index": 23, "kind": "property", "displayName": "Log Phi",
"group": "advanced", "label": "advanced", "required": false, "type": "boolean",
"javaType": "java.lang.Boolean", "deprecated": false, "autowired": false,
"secret": false, "defaultValue": true, "description": "Whether to log PHI" },
+ "logPhi": { "index": 23, "kind": "property", "displayName": "Log Phi",
"group": "advanced", "label": "advanced", "required": false, "type": "boolean",
"javaType": "java.lang.Boolean", "deprecated": false, "autowired": false,
"secret": false, "defaultValue": false, "description": "Whether to log PHI" },
"logPhiMaxBytes": { "index": 24, "kind": "property", "displayName": "Log
Phi Max Bytes", "group": "advanced", "label": "advanced", "required": false,
"type": "integer", "javaType": "java.lang.Integer", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": 5120, "description": "Set
the maximum number of bytes of PHI that will be logged in a log entry." },
"maxBufferSize": { "index": 25, "kind": "property", "displayName": "Max
Buffer Size", "group": "advanced", "label": "advanced", "required": false,
"type": "integer", "javaType": "int", "deprecated": false, "autowired": false,
"secret": false, "defaultValue": 1073741824, "configurationClass":
"org.apache.camel.component.mllp.MllpConfiguration", "configurationField":
"configuration", "description": "Maximum buffer size used when receiving or
sending data over the wire." },
"minBufferSize": { "index": 26, "kind": "property", "displayName": "Min
Buffer Size", "group": "advanced", "label": "advanced", "required": false,
"type": "integer", "javaType": "int", "deprecated": false, "autowired": false,
"secret": false, "defaultValue": 2048, "configurationClass":
"org.apache.camel.component.mllp.MllpConfiguration", "configurationField":
"configuration", "description": "Minimum buffer size used when receiving or
sending data over the wire." },
diff --git
a/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/MllpComponent.java
b/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/MllpComponent.java
index bffd141c42e4..e0b6eef63d5d 100644
---
a/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/MllpComponent.java
+++
b/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/MllpComponent.java
@@ -29,8 +29,8 @@ import org.apache.camel.support.DefaultComponent;
@Component("mllp")
public class MllpComponent extends DefaultComponent implements
SSLContextParametersAware {
- @Metadata(label = "advanced", defaultValue = "true")
- private boolean logPhi = true;
+ @Metadata(label = "advanced", defaultValue = "false")
+ private boolean logPhi;
@Metadata(label = "advanced", defaultValue = "5120")
private int logPhiMaxBytes = 5120;
@Metadata(label = "advanced", defaultValue = "ISO-8859-1")
diff --git
a/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/MllpTcpServerConsumer.java
b/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/MllpTcpServerConsumer.java
index 9d88c6a21071..950e1a4f7fb5 100644
---
a/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/MllpTcpServerConsumer.java
+++
b/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/MllpTcpServerConsumer.java
@@ -641,7 +641,7 @@ public class MllpTcpServerConsumer extends DefaultConsumer {
log.debug("sendAcknowledgement(originalHl7MessageBytes[{}],
Exchange[{}], {}) - Sending Acknowledgement: {}",
originalHl7MessageBytes == null ? -1 :
originalHl7MessageBytes.length, exchange.getExchangeId(),
consumerRunnable.getSocket(),
-
consumerRunnable.getMllpBuffer().toPrintFriendlyHl7String());
+
hl7Util.convertToLoggableString(consumerRunnable.getMllpBuffer().toMllpPayload()));
}
try {
@@ -665,7 +665,7 @@ public class MllpTcpServerConsumer extends DefaultConsumer {
log.debug("sendAcknowledgement(originalHl7MessageBytes[{}],
Exchange[{}], {}) - Sending Acknowledgement: {}",
originalHl7MessageBytes == null ? -1 :
originalHl7MessageBytes.length, exchange.getExchangeId(),
consumerRunnable.getSocket(),
-
hl7Util.convertToPrintFriendlyString(acknowledgementMessageBytes));
+
hl7Util.convertToLoggableString(acknowledgementMessageBytes));
}
try {
diff --git
a/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/internal/Hl7Util.java
b/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/internal/Hl7Util.java
index d02576554ffc..3d3a308a8767 100644
---
a/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/internal/Hl7Util.java
+++
b/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/internal/Hl7Util.java
@@ -33,6 +33,11 @@ import org.slf4j.LoggerFactory;
public final class Hl7Util {
public static final String NULL_REPLACEMENT_VALUE = "<null>";
public static final String EMPTY_REPLACEMENT_VALUE = "<>";
+ /**
+ * Substituted for message content when {@code logPhi} is disabled. The
conversion methods are reached from log
+ * statements and from exception messages, so honouring the flag here
covers both.
+ */
+ public static final String PHI_SUPPRESSED_REPLACEMENT_VALUE = "<PHI
suppressed>";
public static final Map<Character, String> CHARACTER_REPLACEMENTS;
@@ -92,6 +97,31 @@ public final class Hl7Util {
return logPhiMaxBytes;
}
+ public boolean isLogPhi() {
+ return logPhi;
+ }
+
+ /**
+ * Message content for a log statement: the content itself when {@code
logPhi} is enabled, a placeholder otherwise.
+ * <p>
+ * Deliberately separate from {@link
#convertToPrintFriendlyString(byte[])}, which is not a logging helper - it also
+ * extracts the MSH-9 field when an acknowledgement is generated, so
redacting inside it corrupts the
+ * acknowledgement rather than the log.
+ */
+ public String convertToLoggableString(byte[] phiBytes) {
+ if (!logPhi) {
+ return PHI_SUPPRESSED_REPLACEMENT_VALUE;
+ }
+ return convertToPrintFriendlyString(phiBytes);
+ }
+
+ public String convertToLoggableString(byte[] phiBytes, int startPosition,
int endPosition) {
+ if (!logPhi) {
+ return PHI_SUPPRESSED_REPLACEMENT_VALUE;
+ }
+ return convertToPrintFriendlyString(phiBytes, startPosition,
endPosition);
+ }
+
public String generateInvalidPayloadExceptionMessage(final byte[]
hl7Bytes) {
if (hl7Bytes == null) {
return "HL7 payload is null";
diff --git
a/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/internal/MllpSocketBuffer.java
b/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/internal/MllpSocketBuffer.java
index 6d60157f9693..ca8bb67a2589 100644
---
a/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/internal/MllpSocketBuffer.java
+++
b/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/internal/MllpSocketBuffer.java
@@ -255,7 +255,7 @@ public class MllpSocketBuffer {
if (!hasEndOfData() && hasEndOfBlock() &&
endOfBlockIndex < size() - 1) {
LOG.warn("readFrom({}, {}, {}) - exiting with
partial payload {}", socket, receiveTimeout,
readTimeout,
-
hl7Util.convertToPrintFriendlyString(buffer, 0, size() - 1));
+ hl7Util.convertToLoggableString(buffer, 0,
size() - 1));
}
}
}
@@ -411,6 +411,18 @@ public class MllpSocketBuffer {
return answer;
}
+ /**
+ * The buffer content for a log statement, honouring the component's
{@code logPhi} setting, and resetting the
+ * buffer either way so the caller's behaviour does not depend on whether
logging is enabled.
+ */
+ public String toLoggableStringAndReset() {
+ String answer = hl7Util.isLogPhi() ? toPrintFriendlyString() :
Hl7Util.PHI_SUPPRESSED_REPLACEMENT_VALUE;
+
+ reset();
+
+ return answer;
+ }
+
public String toHl7String() {
lock.lock();
try {
@@ -736,7 +748,7 @@ public class MllpSocketBuffer {
} else {
LOG.warn(
"readSocketInputStream(socketInputStream, {}) -
ignoring {} bytes received before START_OF_BLOCK: {}",
- socket, size(), toPrintFriendlyStringAndReset());
+ socket, size(), toLoggableStringAndReset());
}
}
} catch (SocketTimeoutException timeoutEx) {
diff --git
a/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/internal/TcpSocketConsumerRunnable.java
b/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/internal/TcpSocketConsumerRunnable.java
index 66b2df1b5ebc..794371fab455 100644
---
a/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/internal/TcpSocketConsumerRunnable.java
+++
b/components/camel-mllp/src/main/java/org/apache/camel/component/mllp/internal/TcpSocketConsumerRunnable.java
@@ -151,16 +151,16 @@ public class TcpSocketConsumerRunnable implements
Runnable {
hl7MessageBytes = mllpBuffer.toMllpPayload();
if (log.isDebugEnabled()) {
log.debug("Received {} byte message {}",
hl7MessageBytes.length,
-
hl7Util.convertToPrintFriendlyString(hl7MessageBytes));
+
hl7Util.convertToLoggableString(hl7MessageBytes));
}
if (mllpBuffer.hasLeadingOutOfBandData()) {
// TODO: Move the conversion utilities to the
MllpSocketBuffer to avoid a byte[] copy
log.warn("Ignoring leading out-of-band data: {}",
-
hl7Util.convertToPrintFriendlyString(mllpBuffer.getLeadingOutOfBandData()));
+
hl7Util.convertToLoggableString(mllpBuffer.getLeadingOutOfBandData()));
}
if (mllpBuffer.hasTrailingOutOfBandData()) {
log.warn("Ignoring trailing out-of-band data: {}",
-
hl7Util.convertToPrintFriendlyString(mllpBuffer.getTrailingOutOfBandData()));
+
hl7Util.convertToLoggableString(mllpBuffer.getTrailingOutOfBandData()));
}
mllpBuffer.reset();
@@ -168,12 +168,12 @@ public class TcpSocketConsumerRunnable implements
Runnable {
} else if (!mllpBuffer.hasStartOfBlock()) {
byte[] payload = mllpBuffer.toByteArray();
log.warn("Ignoring {} byte un-enveloped payload {}",
payload.length,
- hl7Util.convertToPrintFriendlyString(payload));
+ hl7Util.convertToLoggableString(payload));
mllpBuffer.reset();
} else if (!mllpBuffer.isEmpty()) {
byte[] payload = mllpBuffer.toByteArray();
log.warn("Partial {} byte payload received {}",
payload.length,
- hl7Util.convertToPrintFriendlyString(payload));
+ hl7Util.convertToLoggableString(payload));
}
} catch (SocketTimeoutException timeoutEx) {
if (mllpBuffer.isEmpty()) {
diff --git
a/components/camel-mllp/src/test/java/org/apache/camel/component/mllp/LogPhiTest.java
b/components/camel-mllp/src/test/java/org/apache/camel/component/mllp/LogPhiTest.java
index 49e64c431b52..e0c139685cb6 100644
---
a/components/camel-mllp/src/test/java/org/apache/camel/component/mllp/LogPhiTest.java
+++
b/components/camel-mllp/src/test/java/org/apache/camel/component/mllp/LogPhiTest.java
@@ -106,9 +106,13 @@ public class LogPhiTest extends CamelTestSupport {
testLogPhi(startLogPhi, exceptionMessage ->
assertTrue(exceptionMessage.contains("hl7Message")));
}
+ /**
+ * logPhi now defaults to false, so the default behaves like
testLogPhiFalse: for a protocol whose payload is
+ * patient data by definition, content stays out of the log unless it is
asked for.
+ */
@Test
public void testLogPhiDefault() throws Exception {
- testLogPhi(startDefaultPhi, exceptionMessage ->
assertTrue(exceptionMessage.contains("hl7Message")));
+ testLogPhi(startDefaultPhi, exceptionMessage ->
assertFalse(exceptionMessage.contains("hl7Message")));
}
public void testLogPhi(Endpoint endpoint, Consumer<String> contains) {
diff --git
a/components/camel-mllp/src/test/java/org/apache/camel/component/mllp/internal/Hl7UtilTest.java
b/components/camel-mllp/src/test/java/org/apache/camel/component/mllp/internal/Hl7UtilTest.java
index 0103c2a4bfbc..82b1cba72ba8 100644
---
a/components/camel-mllp/src/test/java/org/apache/camel/component/mllp/internal/Hl7UtilTest.java
+++
b/components/camel-mllp/src/test/java/org/apache/camel/component/mllp/internal/Hl7UtilTest.java
@@ -682,6 +682,15 @@ public class Hl7UtilTest {
assertEquals("MSH", result);
}
+ @Test
+ public void testConvertToLoggableStringHonorsLogPhi() {
+ Hl7Util suppressed = new Hl7Util(5120, false);
+
+ assertEquals(Hl7Util.PHI_SUPPRESSED_REPLACEMENT_VALUE,
+ suppressed.convertToLoggableString(TEST_MESSAGE_BYTES));
+ assertEquals(EXPECTED_MESSAGE,
hl7util.convertToLoggableString(TEST_MESSAGE_BYTES));
+ }
+
@Test
public void testGenerateAcknowledgementPayloadWithOnlyMsh91() throws
Exception {
final MllpSocketBuffer mllpSocketBuffer = new MllpSocketBuffer(new
MllpEndpointStub());
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
index 8cfe4267a2f3..7e69416ee60c 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
@@ -544,6 +544,23 @@ is truncated rather than recreated and would otherwise
keep its original permiss
Deployments where another account legitimately reads these files — a sidecar
or a backup agent running as
a different user — need to run as the owner, or use a group-aware key store
instead.
+=== camel-mllp
+
+`logPhi` now defaults to `false`. It previously defaulted to `true`, so
message content — which for MLLP
+is patient data by definition — reached the log at the default INFO/WARN
levels with no configuration at
+all. Set `logPhi=true` on the component to restore the previous behaviour.
+
+Payload-bearing log paths that ignored the flag no longer do, including:
+`MllpSocketBuffer.readFrom` (the partial-payload warning, which logs the
content of a legitimate
+in-flight message from a slow sender, not only unexpected bytes) and
+`MllpSocketBuffer.readSocketInputStream` (the bytes-before-START_OF_BLOCK
warning), the invalid and partial-payload
+warnings in `TcpSocketConsumerRunnable`, and acknowledgement debug logging.
Where content is suppressed the log now
+shows `<PHI suppressed>`.
+
+The suppression is applied at the log statements, through a new
`Hl7Util.convertToLoggableString`, rather
+than inside `convertToPrintFriendlyString`: that method is not a logging
helper — it also extracts the
+MSH-9 field when an acknowledgement is generated, so redacting inside it would
corrupt acknowledgements.
+
=== camel-platform-http
`PlatformHttpEndpoint.isHttpProxy()` selected proxy mode with
`path.startsWith("proxy")` rather than an
