oscerd opened a new pull request, #26204: URL: https://github.com/apache/camel/pull/26204
## What Twenty-seven advisories came out of the last review round. Most landed in classes the model already describes — header injection, unsafe deserialisation, auth bypass — and needed nothing. Four patterns recurred often enough that a component author reading this page would not have caught them, so they are now stated explicitly. **A new in-scope class: _State shared between exchanges_.** Mutable state a component reuses across messages, where the sender of message A need not be the sender of message B: - `camel-thrift` unmarshalled into the type's shared `defaultInstance` (CAMEL-24442) - `camel-pqc` used one unsynchronized `Signature` for every exchange (CAMEL-24445) - `camel-as2` kept per-request signing material in shared state (CAMEL-24429) - `camel-http` keyed its JVM-global OAuth2 token cache on fewer fields than shape the token (CAMEL-24456) The entry deliberately draws a line: an interleaving that only spoils its own exchange is a correctness bug; it is in scope when the shared state carries authority, identity or another party's data. **The `muteException` shape generalised past HTTP.** The model cited CVE-2026-49365 and CVE-2026-56139 as HTTP cases. It has since been found in every consumer that writes a failure back to its caller — `camel-knative`, `camel-mina`, `camel-cxf`, `camel-grpc` — so the information-disclosure class now states the rule directly, and notes that a contract-declared fault (a JAX-WS `@WebFault`) is the one thing that must still be reported. **Two insecure-default shapes**, both reached by *omission* rather than opt-in, which is what separates them from `trustAllCertificates=true` and the other documented opt-ins that are out of scope: - enabling SSL without a truststore falling back to trust-all rather than to the JVM default trust anchors - enabling CORS granting credentials to an origin nobody named **Two variants of the existing matching-consistency rule:** a case-sensitive header comparison that HTTP/2 makes unconditionally inert rather than merely bypassable (CAMEL-24453), and proxy mode selected by prefix rather than exact match (CAMEL-24455). The component-author checklist gains three matching questions: state kept between exchanges, credentials sent to an authority the route did not choose, and consumers that write a reply. ## Why These are the classes that cost the most review time in the last round, and each produced more than one advisory. Writing them down is cheaper than rediscovering them per component. ## Scope Documentation only — one file, 106 lines added, nothing removed or reworded. No change to what is in or out of scope; every addition names a pattern already accepted under an existing class, or in the case of shared state, one the model had no entry for at all. ## Verification Rendered with `asciidoctor` against the pre-change file as a baseline. Both render clean; no new warnings, so the camel-website Antora build is unaffected. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017Ag2vggKF2RjhPFK2JiUy1 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
