oscerd commented on code in PR #27719:
URL: https://github.com/apache/camel/pull/27719#discussion_r4256470834
##########
components/camel-lra/src/main/java/org/apache/camel/service/lra/LRASagaRoutes.java:
##########
@@ -106,13 +107,19 @@ private void verifyCompletionRequest(Exchange exchange) {
/**
* Check if the request is pointing to an allowed URI to prevent
unauthorized remote uri invocation. Validates only
- * the URI relevant to the callback type against the corresponding
allowlist.
+ * the URI relevant to the callback type against the corresponding
allowlist. When a callback secret is configured,
+ * the signature of the called URL is verified first.
*/
private void verifyRequest(Exchange exchange, boolean isCompensation) {
if (exchange.getIn().getHeader(Exchange.SAGA_LONG_RUNNING_ACTION) ==
null) {
throw new IllegalArgumentException("Missing " +
Exchange.SAGA_LONG_RUNNING_ACTION + " header in received request");
}
+ LRACallbackSigner signer = sagaService.getCallbackSigner();
+ if (signer != null && !applySignedParameters(exchange, signer,
isCompensation)) {
Review Comment:
Confirmed, and fixed in 3a2ad47d9394: when a callback secret is set, the
step URIs now come only from the signed parameters. After a valid signature,
`verifyRequest()` goes straight to the allowlist check and returns, so the
CAMEL-17751 fallback no longer reads `CamelHttpQuery` in that mode.
`signedCallbackWithoutStepUrisDoesNotReadThemFromTheQuery` covers your case: a
step without URIs, a signed option value holding an encoded
`&Camel-Saga-Compensate=...`, and a decoded `CamelHttpQuery`. It fails without
the change. The branch is also rebased on main after #27725, with the generated
files regenerated for both options.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
