oscerd opened a new pull request, #28560: URL: https://github.com/apache/camel/pull/28560
Jira: https://issues.apache.org/jira/browse/CAMEL-26340 ### Problem In `LRASagaService.newSaga(Exchange)` (camel-lra), when starting a new LRA, the URL returned by the coordinator is used directly to create `LRASagaCoordinator` without verifying that the URL is hosted by the configured coordinator or listed in `allowedCoordinatorUrls`. In contrast, `getSaga(String id)` applies `isHostedByAllowedCoordinator`. As a result, an LRA URL returned when starting a saga is joined, completed, or compensated without host and context path verification. ### Change - In `LRASagaService.newSaga(Exchange)`: validate the URL returned by `client.newLRA(exchange)` via `isHostedByAllowedCoordinator(URI)`. If the URL is not hosted by an allowed coordinator, fail the future with `IllegalArgumentException`. - Added helper method `toUri(URL url)` to safely convert the returned URL to URI for coordinator validation. ### Tests - Added unit tests in `LRASagaServiceTest`: - `testNewSagaAcceptsAllowedCoordinatorUrl`: verifies that an LRA URL matching the configured coordinator is accepted. - `testNewSagaRejectsUnapprovedHost`: verifies that an LRA URL pointing to an unapproved host fails with `IllegalArgumentException`. - `testNewSagaRejectsPathOutsideCoordinatorContextPath`: verifies that an LRA URL with a path outside the coordinator context path fails with `IllegalArgumentException`. - `testNewSagaAcceptsAlternativeAllowedCoordinatorUrl`: verifies that an LRA URL matching `allowedCoordinatorUrls` is accepted. - All 82 unit tests in `camel-lra` pass cleanly. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
