oscerd commented on code in PR #26745: URL: https://github.com/apache/camel/pull/26745#discussion_r4081178593
########## docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc: ########## @@ -2500,3 +2500,33 @@ Due to the package rename from `com.bazaarvoice.jolt` to `io.joltcommunity.jolt` `ContextualTransform` classes into a Chainr spec need to update their imports to `io.joltcommunity.jolt.Transform` and `io.joltcommunity.jolt.ContextualTransform`. Users referencing `Removr` directly also need to update their import to `io.joltcommunity.jolt.removr.Removr`. + +=== camel-mustache, camel-chunk - potential breaking change + +The Exchange header constants in `MustacheConstants` and `ChunkConstants` have been renamed to +follow the Camel naming convention used across the rest of the component catalog (so that they are +handled consistently by `DefaultHeaderFilterStrategy`, like the other template components). The Java +field names are unchanged; only the header string values have changed. + +`MustacheConstants`: + +[options="header"] +|=== +| Constant | Previous value | New value +| `MustacheConstants.MUSTACHE_RESOURCE_URI` | `MustacheResourceUri` | `CamelMustacheResourceUri` +| `MustacheConstants.MUSTACHE_TEMPLATE` | `MustacheTemplate` | `CamelMustacheTemplate` +|=== + +`ChunkConstants`: + +[options="header"] +|=== +| Constant | Previous value | New value +| `ChunkConstants.CHUNK_RESOURCE_URI` | `ChunkResourceUri` | `CamelChunkResourceUri` +| `ChunkConstants.CHUNK_TEMPLATE` | `ChunkTemplate` | `CamelChunkTemplate` +|=== + +Routes that reference the constants (for example `setHeader(MustacheConstants.MUSTACHE_TEMPLATE, ...)`) +are unaffected. Routes that set the header by its literal string name, or that use +`allowTemplateFromHeader=true` with the old header names, must switch to the new `Camel`-prefixed +names. Review Comment: Added in 7d792fed78d5 — the entry now explains that the old unprefixed names were not stripped by `DefaultHeaderFilterStrategy`, so with `allowTemplateFromHeader=true` a template or resource header from an untrusted sender reached the producer, and that the `Camel` prefix now filters them at the component boundary, with a note not to simply restore the old names. One wording point: I framed the impact as untrusted input reaching the producer / information disclosure rather than arbitrary code execution. Mustache is logic-less, so a message-supplied template discloses exchange data (headers/body) and the resource-URI header can read a server-side file, but it is not code execution. Thanks for the thorough review. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
