oscerd commented on code in PR #27721:
URL: https://github.com/apache/camel/pull/27721#discussion_r4269013936
##########
components/camel-chunk/src/main/java/org/apache/camel/component/chunk/ChunkEndpoint.java:
##########
@@ -134,6 +142,37 @@ protected void onExchange(Exchange exchange) throws
Exception {
}
}
+ /**
+ * Neutralizes message data so the Chunk engine does not parse and expand
template tags present inside the data
+ * itself. A String value is wrapped as a literal Chunk snippet only when
it actually contains Chunk tags (as
+ * reported by Chunk's own parser via {@link Snippet#isSimple()});
tag-free values are left as-is so Chunk's string
+ * filters (for example {@code slice}, {@code get}, {@code join}) keep
their existing behaviour. Nested {@link Map}
+ * values (such as the message headers or variables) are copied and
processed recursively, preserving a
+ * case-insensitive headers map. Other value types are left unchanged.
+ */
+ @SuppressWarnings("unchecked")
+ private static Object toLiteralValue(Object value, HeadersMapFactory
factory) {
+ if (value instanceof String) {
+ String str = (String) value;
+ // Only neutralize values that would otherwise be re-parsed as
template code (i.e. that contain tags);
+ // leaving tag-free data as a plain String keeps Chunk's string
filters working as before.
+ if (!Snippet.getSnippet(str).isSimple()) {
+ return Snippet.makeLiteralSnippet(str);
+ }
+ return str;
+ }
+ if (value instanceof Map) {
+ Map<?, ?> map = (Map<?, ?>) value;
+ Map<String, Object> copy = factory.isInstanceOf((Map<String,
Object>) value)
+ ? factory.newMap() : new LinkedHashMap<>();
+ for (Map.Entry<?, ?> entry : map.entrySet()) {
+ copy.put(String.valueOf(entry.getKey()),
toLiteralValue(entry.getValue(), factory));
+ }
+ return copy;
+ }
+ return value;
Review Comment:
Addressed in `f82cb8c`: `toLiteralValue` now also recurses into
`CharSequence` (StringBuilder etc. via `toString()`), `Collection` and
`Object[]`, in addition to `Map` — all still `isSimple()`-gated. Verified
against chunk-templates 3.6.2: a StringBuilder body and a List of Maps (`{%
loop in $body as x %}{$x.k}{% endloop %}`) now render literally; tests added
for both.
One correction worth noting: recursing into collections fixes a list **of
maps** (the `{$x.k}` value stays a Snippet), but a `{% loop %}` over raw
**String** items printed with `{$x}` is still re-parsed — Chunk re-stringifies
the loop variable, so the binding can't intercept it. That case, together with
filter output and bean string properties, is now called out in the new
`Security` section of `chunk-component.adoc` and the 4.24 upgrade guide.
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
##########
docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc:
##########
@@ -366,6 +366,17 @@ Previously it returned only the first chunk of the event
log (at most 500 events
any sign. A wide `after`/`before` window now returns every event in one list:
that is one request per 500 events plus
one that finds the end of the log, and more memory. Narrow the window when the
event log is large.
+=== camel-chunk - message data containing Chunk tags is rendered literally
+
+Previously the `chunk` component bound the message body, headers and variables
into the Chunk engine in a
+way that caused Chunk to re-parse those values as template source: a value
that itself contained Chunk tags
+(such as a body of `{$headers.name}`) had those tags expanded instead of being
printed verbatim.
+
+Message values that contain Chunk tags are now rendered literally, so only the
route author's template file
Review Comment:
Reworded in `f82cb8c`: the note now says only a direct `{$tag}` is
protected, and that the output of a filter (`{$body|trim}`,
`{$body|urldecode}`), a `String` item in a `{% loop %}`, and `String`
properties of a bean body (`{$body.name}`, `{$exception.message}`) are still
parsed as template code — with guidance to keep untrusted data to direct
`{$tag}` output and not pass it through filters, bean properties or loops. The
same caveat is added as a `Security` section in `chunk-component.adoc` (catalog
mirror synced).
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
