This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 02563254b8fd CAMEL-25704: camel-undertow - add the 4.22.3 and 4.18.6
upgrade-guide notes on main (#28078)
02563254b8fd is described below
commit 02563254b8fd7c933967e1a955409bec06538c14
Author: Andrea Cosentino <[email protected]>
AuthorDate: Mon Oct 19 13:31:05 2026 +0200
CAMEL-25704: camel-undertow - add the 4.22.3 and 4.18.6 upgrade-guide notes
on main (#28078)
Signed-off-by: Andrea Cosentino <[email protected]>
Co-Authored-By: Claude Opus 4.8 <[email protected]>
---
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 11 +++++++++++
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 11 +++++++++++
2 files changed, 22 insertions(+)
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index 985efec21118..b061bb9c34b3 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -258,6 +258,17 @@ receive the messages of the producers, and it is closed
when it sends a message.
A WebSocket client that connected without satisfying the configured security
provider or allowed roles is now
rejected: it must authenticate, or the option must be removed from the
WebSocket endpoint.
+=== camel-undertow - the producer refuses a request target or header value
with control characters
+
+The undertow producer writes the path, query and header values of the outgoing
request to the socket one character at
+a time, without validating them. A carriage return or line feed therefore
broke the request into further lines, and a
+character above `0xFF` was written as a single, different byte (for example
`U+010A` became a line feed). The producer
+now refuses to send a request path, query or header value that contains a
control character or a character above
+`0xFF`, and fails the exchange with an `IllegalArgumentException` instead. A
space and a tab, which do not change the
+framing, are still allowed. Routes that put a percent-encoded control
character (such as `%0D%0A`) into the
+`CamelHttpPath` or `CamelHttpQuery` header, which the producer decodes before
building the request, are the ones most
+likely to be affected.
+
== Upgrading from 4.18.4 to 4.18.5
=== camel-azure-eventhubs
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index 7e4e77ef8e97..49fe930a832e 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -60,6 +60,17 @@ multi-host cluster still receives them. Previously they were
registered for any
including the host of a node with another scheme or port, is now sent without
them. A client set with the `client` or
`openSearchClient` option is not changed.
+=== camel-undertow - the producer refuses a request target or header value
with control characters
+
+The undertow producer writes the path, query and header values of the outgoing
request to the socket one character at
+a time, without validating them. A carriage return or line feed therefore
broke the request into further lines, and a
+character above `0xFF` was written as a single, different byte (for example
`U+010A` became a line feed). The producer
+now refuses to send a request path, query or header value that contains a
control character or a character above
+`0xFF`, and fails the exchange with an `IllegalArgumentException` instead. A
space and a tab, which do not change the
+framing, are still allowed. Routes that put a percent-encoded control
character (such as `%0D%0A`) into the
+`CamelHttpPath` or `CamelHttpQuery` header, which the producer decodes before
building the request, are the ones most
+likely to be affected.
+
== Upgrading from 4.22.1 to 4.22.2
=== camel-lra - only an LRA hosted by the configured coordinator is joined
