oscerd commented on code in PR #26745:
URL: https://github.com/apache/camel/pull/26745#discussion_r4081178593


##########
docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc:
##########
@@ -2500,3 +2500,33 @@ Due to the package rename from `com.bazaarvoice.jolt` to 
`io.joltcommunity.jolt`
 `ContextualTransform` classes into a Chainr spec need to update their imports 
to `io.joltcommunity.jolt.Transform` and
 `io.joltcommunity.jolt.ContextualTransform`.
 Users referencing `Removr` directly also need to update their import to 
`io.joltcommunity.jolt.removr.Removr`.
+
+=== camel-mustache, camel-chunk - potential breaking change
+
+The Exchange header constants in `MustacheConstants` and `ChunkConstants` have 
been renamed to
+follow the Camel naming convention used across the rest of the component 
catalog (so that they are
+handled consistently by `DefaultHeaderFilterStrategy`, like the other template 
components). The Java
+field names are unchanged; only the header string values have changed.
+
+`MustacheConstants`:
+
+[options="header"]
+|===
+| Constant | Previous value | New value
+| `MustacheConstants.MUSTACHE_RESOURCE_URI` | `MustacheResourceUri` | 
`CamelMustacheResourceUri`
+| `MustacheConstants.MUSTACHE_TEMPLATE` | `MustacheTemplate` | 
`CamelMustacheTemplate`
+|===
+
+`ChunkConstants`:
+
+[options="header"]
+|===
+| Constant | Previous value | New value
+| `ChunkConstants.CHUNK_RESOURCE_URI` | `ChunkResourceUri` | 
`CamelChunkResourceUri`
+| `ChunkConstants.CHUNK_TEMPLATE` | `ChunkTemplate` | `CamelChunkTemplate`
+|===
+
+Routes that reference the constants (for example 
`setHeader(MustacheConstants.MUSTACHE_TEMPLATE, ...)`)
+are unaffected. Routes that set the header by its literal string name, or that 
use
+`allowTemplateFromHeader=true` with the old header names, must switch to the 
new `Camel`-prefixed
+names.

Review Comment:
   Added in 7d792fed78d5 — the entry now explains that the old unprefixed names 
were not stripped by `DefaultHeaderFilterStrategy`, so with 
`allowTemplateFromHeader=true` a template or resource header from an untrusted 
sender reached the producer, and that the `Camel` prefix now filters them at 
the component boundary, with a note not to simply restore the old names.
   
   One wording point: I framed the impact as untrusted input reaching the 
producer / information disclosure rather than arbitrary code execution. 
Mustache is logic-less, so a message-supplied template discloses exchange data 
(headers/body) and the resource-URI header can read a server-side file, but it 
is not code execution. Thanks for the thorough review.
   
   _Claude Code on behalf of oscerd_



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to