(camel-quarkus) branch main updated: Fixes #9058. Serve only the diagram consoles from the diagram route

[jamesnetherton]

This is an automated email from the ASF dual-hosted git repository.

jamesnetherton pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-quarkus.git


The following commit(s) were added to refs/heads/main by this push:
     new 94724b7c77 Fixes #9058. Serve only the diagram consoles from the 
diagram route
94724b7c77 is described below

commit 94724b7c77abde050656c591dce6919e55cdfa9d
Author: Andrea Cosentino <anco...@gmail.com>
AuthorDate: Tue Sep 1 12:06:01 2026 +0200

    Fixes #9058. Serve only the diagram consoles from the diagram route
    
    CamelDiagramHandler resolved the :id path parameter against the whole
    DevConsoleRegistry, so the route registered for diagrams rendered any 
console
    that happened to be registered. camel-quarkus-diagram depends on
    camel-quarkus-console, so in the integration test app that meant context, 
jvm,
    health, java-security, bean, consumer, endpoint, gc and log all answered on
    /q/camel/diagram/{id}.
    
    Restrict selection to the three consoles this route exists to serve, 
matching
    the allowlist CamelCoreDevUIService already applies to the Dev UI bridge.
    
    This is dev mode only - DiagramProcessor is @BuildSteps(onlyIf =
    IsDevelopment.class).
    
    Co-authored-by: Claude Opus 5 (1M context) <nore...@anthropic.com>
---
 .../quarkus/component/diagram/CamelDiagramRecorder.java      | 10 +++++++++-
 .../camel/quarkus/component/diagram/it/DiagramTest.java      | 12 ++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git 
a/extensions-jvm/diagram/runtime/src/main/java/org/apache/camel/quarkus/component/diagram/CamelDiagramRecorder.java
 
b/extensions-jvm/diagram/runtime/src/main/java/org/apache/camel/quarkus/component/diagram/CamelDiagramRecorder.java
index 3bca2a9fcc..3339e990f1 100644
--- 
a/extensions-jvm/diagram/runtime/src/main/java/org/apache/camel/quarkus/component/diagram/CamelDiagramRecorder.java
+++ 
b/extensions-jvm/diagram/runtime/src/main/java/org/apache/camel/quarkus/component/diagram/CamelDiagramRecorder.java
@@ -18,6 +18,7 @@ package org.apache.camel.quarkus.component.diagram;
 
 import java.util.HashMap;
 import java.util.Map;
+import java.util.Set;
 import java.util.function.Consumer;
 
 import io.quarkus.runtime.RuntimeValue;
@@ -49,6 +50,13 @@ public class CamelDiagramRecorder {
     }
 
     static final class CamelDiagramHandler implements Handler<RoutingContext> {
+        /**
+         * The consoles this route exists to serve. The id is resolved against 
the registry, which holds every
+         * registered console, so without this an unrelated console could be 
rendered through the diagram route.
+         */
+        private static final Set<String> DIAGRAM_CONSOLE_IDS = 
Set.of("route-diagram", "route-structure",
+                "route-topology");
+
         private final DevConsoleRegistry devConsoleRegistry;
 
         CamelDiagramHandler(DevConsoleRegistry devConsoleRegistry) {
@@ -63,7 +71,7 @@ public class CamelDiagramRecorder {
             }
 
             String id = ctx.pathParam("id");
-            if (id == null || id.isEmpty()) {
+            if (id == null || !DIAGRAM_CONSOLE_IDS.contains(id)) {
                 ctx.response().setStatusCode(404).end();
                 return;
             }
diff --git 
a/integration-tests-jvm/diagram/src/test/java/org/apache/camel/quarkus/component/diagram/it/DiagramTest.java
 
b/integration-tests-jvm/diagram/src/test/java/org/apache/camel/quarkus/component/diagram/it/DiagramTest.java
index eb6676a931..4a78e285bb 100644
--- 
a/integration-tests-jvm/diagram/src/test/java/org/apache/camel/quarkus/component/diagram/it/DiagramTest.java
+++ 
b/integration-tests-jvm/diagram/src/test/java/org/apache/camel/quarkus/component/diagram/it/DiagramTest.java
@@ -23,6 +23,8 @@ import org.jboss.shrinkwrap.api.asset.StringAsset;
 import org.jboss.shrinkwrap.api.spec.JavaArchive;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.emptyString;
@@ -83,4 +85,14 @@ class DiagramTest {
                 .then()
                 .statusCode(404);
     }
+
+    @ParameterizedTest
+    @ValueSource(strings = { "context", "jvm", "health", "java-security" })
+    void nonDiagramConsoleIsNotReachable(String consoleId) {
+        // These consoles are registered and were previously rendered by this 
route, which exists only to serve
+        // the diagram consoles
+        RestAssured.get("/q/camel/diagram/" + consoleId)
+                .then()
+                .statusCode(404);
+    }
 }