atiaomar1978-hub opened a new pull request, #26026: URL: https://github.com/apache/camel/pull/26026
## Summary Fixes [CAMEL-24578](https://issues.apache.org/jira/browse/CAMEL-24578): `camel-avro-rpc` (and `camel-avro`) fail with Apache Avro 1.12.2 because `ClassSecurityValidator` rejects IPC handshake and application model classes unless the `SERIALIZABLE_PACKAGES` JVM property is set manually. This PR configures Avro's `ClassSecurityValidator` at runtime so routes work out of the box: - **`AvroClassSecuritySupport`** (in `camel-avro`) maintains an in-memory allowlist and extends the global Avro validator - **`camel-avro-rpc`**: trusts `org.apache.avro.ipc` on component init; infers model packages from protocol class, namespace, and schema types - **`camel-avro` data format**: trusts packages from schema / instance class; trusts marshal graph class at runtime - **New option `serializablePackages`** on Avro RPC endpoints (and data format `@Metadata`) for additional trusted packages, annotated `security = "insecure:serialization"` - **Tests** run without Surefire `-Dorg.apache.avro.SERIALIZABLE_PACKAGES=...` vmargs (68 RPC tests + unit tests pass) - **Upgrade guide** updated to document automatic configuration and the new option ## Review feedback addressed - Allowlist stored in private in-memory sets (not a re-readable system property) - IPC trust scoped to `org.apache.avro.ipc` (RPC component only) - Wildcard `*` rejected explicitly - `@BeforeEach` test isolation via `resetForTesting()` - Negative test for classes outside configured protocol packages ## Test plan - [x] `mvn test -pl components/camel-avro,components/camel-avro-rpc/camel-avro-rpc-component -am` - [x] All 68 `camel-avro-rpc` tests pass without JVM serializable-packages vmargs - [x] New `AvroClassSecuritySupportTest` and `AvroClassSecurityWithoutVmArgsTest` --- _AI-generated PR description by Cursor Agent on behalf of atiaomar1978-hub_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
