oscerd opened a new pull request, #26206: URL: https://github.com/apache/camel/pull/26206
## What Four patterns have come up often enough in review that a component author reading the security model would not have caught them. This adds them as rules and as checklist questions. **A new in-scope class: _State shared between exchanges_.** Mutable state a component holds outside the Exchange and reuses across messages, where the party that sent the earlier message need not be the one that sends the next. The class names the forms it takes — a shared unmarshalling target, a stateful cryptographic primitive, request-scoped key material stored where the next request reaches it, a process-wide cache — and gives two questions that decide it: whether the state is per-exchange in fact as well as in name, and whether a cache key contains everything that changes what the cached value permits. It also draws a line, so the class does not become "any race condition is a vulnerability": an interleaving that only corrupts its own exchange's result is a correctness bug; it is in scope when the shared state carries authority, identity or another party's data. **The `muteException` rule generalised past HTTP.** The model already describes it for HTTP consumers. Any consumer with a reply path can hand the route's failure back to whoever sent the message — as a response body, over a socket, inside a protocol fault, or in a status field transmitted to the caller. The rule is now stated directly, with contract-declared faults as the one thing that must still be reported. **Two insecure-default shapes**, both reached by omission rather than opt-in — which is what separates them from the documented opt-ins that are already out of scope: - enabling transport security while the peer-verification material is unconfigured must fall back to the platform trust anchors, not to accepting every peer - enabling CORS must not grant credentials to an origin nobody named, and `Vary: Origin` belongs on any reflected origin **Two variants of the existing matching-consistency rule:** a case-sensitive comparison against a case-insensitive protocol — which HTTP/2 turns from bypassable into unconditionally absent, since it normalises header names on the wire — and selection by prefix where an exact match was meant. The component-author checklist gains three matching questions: state kept between exchanges, credentials sent to an authority the route did not choose, and consumers that write a reply. ## Scope Documentation only. One file, 89 lines added, nothing removed or reworded. No change to what is in or out of scope beyond the one new class. The additions are written as forward-looking guidance. No component, issue or advisory is named — these are rules for the next component, not a record of past findings. ## Verification Rendered with `asciidoctor` against the pre-change file as a baseline. Both render clean, so the camel-website Antora build is unaffected. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017Ag2vggKF2RjhPFK2JiUy1 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
