allthingssecurity commented on PR #28788: URL: https://github.com/apache/camel/pull/28788#issuecomment-6556477899
Thanks @davsclaus, all four are in f304624e7558. 1. **Chaos page link:** "Chaos rules" in `camel-jbang-managing.adoc` links it again as `xref:next@components:others:chaos.adoc[camel-chaos]`, the same `next@` form as lines 319 and 456. Nothing else in the PR uses a plain `components:` xref to the chaos page. 2. **`change` race:** in the `IllegalArgumentException | IllegalStateException` catch, `change` checks `hasRule` again and answers not-found (exit 3) when the rule is gone, as in your snippet. New `LocalCliConnectorChaosActionTest.aRuleRemovedWhileItIsChangedIsNotFound` uses a fake manager whose `hasRule` answers true and then false, and whose `changeRule` throws `IllegalArgumentException`. It fails without the fix (reason `null` instead of `not-found`). `aChangedRuleThatIsNotValidIsStillAnError` checks that a refused change of a rule that still exists stays a plain error. 3. **`--chaos` with profile `prod`:** `camel run` prints `WARN: camel-chaos stays off with profile prod` through `printer().printWarn`, as the `--data-dir` notice does. It is printed for the jbang and main runtimes; Spring Boot and Quarkus still refuse `--chaos`. Test: `RunTest.chaosWithProfileProdSaysThatChaosStaysOff` (and no warning with profile dev or without `--chaos`). 4. **Security model:** the row in "Per-option opt-ins" is now `camel.chaos.enabled=true`, default unset (on with profile `dev`, never with `prod`). The note says the rules come from `camel.chaos.rules` (`insecure:dev`), Java or `camel cmd chaos-*`, and that `exception=` names any public `Throwable` class. `security-model.yaml` has the same row (`option: camel.chaos.enabled`, `insecure_value: true`, `default: unset`) and still parses. As you said, a committer should confirm the threat-model wording. Tests: `LocalCliConnector*Test`, `RunTest`, `CamelChaosActionTest`, `ListChaosTest`, `CommandInputErrorsTest` and `ToolConfirmsTest` pass. `LocalCliConnectorChaosActionTest` and `RunTest` passed 20 runs each, in their own JVM. The PR description is updated. _Claude Code on behalf of allthingssecurity_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
