davsclaus commented on code in PR #25846:
URL: https://github.com/apache/camel/pull/25846#discussion_r3889906351
##########
docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc:
##########
@@ -13,6 +13,20 @@ See the xref:camel-upgrade-recipes-tool.adoc[documentation]
page for details.
== Upgrading Camel 4.22 to 4.23
+=== camel-exec
+
+`allowControlHeaders` is now annotated `security = "insecure:dev"`.
+With `camel.main.profile = prod` the default policy for that category is
`fail`,
+so an endpoint or component that sets `allowControlHeaders=true` will not start
+unless you relax `camel.security.insecureDevPolicy`.
+
+When the flag is `false` (the default), any remaining `CamelExecCommand*`,
+`CamelExecExitValues`, or `CamelExecUseStderrOnEmptyStdout` headers are ignored
+and a WARN is logged once per binding instance. Those headers never overrode
the
+URI without the flag; they were just silent before.
+
+=== Components removal
+
Review Comment:
This adds an empty `=== Components removal` heading immediately duplicating
the existing `=== Components and Language removal` heading right below it.
Looks like a copy/paste artifact — it renders as a content-less heading in the
published upgrade guide. Suggest removing these two lines.
```suggestion
```
##########
components/camel-exec/src/test/java/org/apache/camel/component/exec/ExecProducerTest.java:
##########
@@ -67,6 +67,25 @@ public void testWithContextConfiguration() {
assertEquals("mockedByCommandExecutorMock.exe",
execCommandExecutorMock.lastCommandResult.getCommand().getExecutable());
}
+ @Test
+ @DirtiesContext
+ public void testIgnoreControlHeadersByDefault() {
+ final String command = "java";
+
+ producerTemplate.send(new Processor() {
+
+ public void process(Exchange exchange) {
+ exchange.getIn().setBody("noinput");
+ exchange.getIn().setHeader(EXEC_COMMAND_EXECUTABLE, command);
+ exchange.getIn().setHeader(EXEC_COMMAND_ARGS,
Arrays.asList("-version"));
+ }
+ });
+
+ assertEquals("mockedByCommandExecutorMock.exe",
+
execCommandExecutorMock.lastCommandResult.getCommand().getExecutable());
+
assertTrue(execCommandExecutorMock.lastCommandResult.getCommand().getArgs().isEmpty());
Review Comment:
Per the project's test conventions, new test code is preferred to use
AssertJ assertions (`assertThat(...)`) instead of JUnit assertions. Not
blocking here since the rest of this file already uses JUnit-style assertions
consistently, but flagging for awareness.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
