gnodet-bot commented on code in PR #26267:
URL: https://github.com/apache/camel/pull/26267#discussion_r3979722009
##########
components/camel-jgroups/src/main/java/org/apache/camel/component/jgroups/JGroupsEndpoint.java:
##########
@@ -82,10 +93,24 @@ public Exchange createExchange(Message message) {
exchange.getIn().setHeader(JGroupsConstants.HEADER_JGROUPS_ORIGINAL_MESSAGE,
message);
exchange.getIn().setHeader(JGroupsConstants.HEADER_JGROUPS_SRC,
message.getSrc());
exchange.getIn().setHeader(JGroupsConstants.HEADER_JGROUPS_DEST,
message.getDest());
- exchange.getIn().setBody(message.getObject());
+ Object body = message.getObject();
+ if (body != null && deserializationFilter != null &&
!deserializationFilter.isBlank()) {
+ checkDeserializedType(body.getClass());
+ }
+ exchange.getIn().setBody(body);
return exchange;
}
+ private void checkDeserializedType(Class<?> type) {
+ ObjectInputFilter filter =
DeserializationFilterHelper.resolveDeserializationFilter(deserializationFilter);
+ if (DeserializationFilterHelper.checkClass(filter, type) ==
ObjectInputFilter.Status.REJECTED) {
+ throw new JGroupsException(
+ "Rejected message body of type " + type.getName()
+ + " received from the JGroups cluster:
it is not permitted by the configured"
+ + " deserializationFilter");
+ }
Review Comment:
⚠️ **Performance:** `resolveDeserializationFilter()` calls
`ObjectInputFilter.Config.createFilter()` on every incoming message. The filter
pattern is immutable after endpoint start, so the `ObjectInputFilter` should be
resolved once and cached — this is what `camel-jms` and `camel-sjms` do
(resolve in the constructor/binding init, store the `ObjectInputFilter` as a
field, then only call `checkClass` on the hot path).
For a high-throughput JGroups cluster this is unnecessary object churn on
every message.
```suggestion
private void checkDeserializedType(Class<?> type) {
if (resolvedDeserializationFilter == null) {
resolvedDeserializationFilter =
DeserializationFilterHelper.resolveDeserializationFilter(deserializationFilter);
}
if
(DeserializationFilterHelper.checkClass(resolvedDeserializationFilter, type) ==
ObjectInputFilter.Status.REJECTED) {
throw new JGroupsException(
"Rejected message body of type " + type.getName()
+ " received from the JGroups
cluster: it is not permitted by the configured"
+ " deserializationFilter");
}
}
```
With a corresponding field:
```java
private ObjectInputFilter resolvedDeserializationFilter;
```
Alternatively, resolve it in `doStart()` to match the lifecycle pattern of
other Camel components.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
