Federico Mariani created CAMEL-24077:
----------------------------------------
Summary: camel-amqp: useSsl=true renders empty transport.* options
- breaks JVM-default trust store and server-only TLS
Key: CAMEL-24077
URL: https://issues.apache.org/jira/browse/CAMEL-24077
Project: Camel
Issue Type: Bug
Components: camel-amqp
Affects Versions: 4.21.0
Reporter: Federico Mariani
Attachments: AMQPSslTransportOptionsTest.java
h3. Problem
When {{useSsl=true}}, {{AMQPComponent.doInit()}} (AMQPComponent.java:113-131)
always appends all six {{transport.*}} options to the connection URI,
substituting {{""}} for the ones that are not configured. Qpid JMS (2.10.0)
parses {{key=}} as the empty string (not null), and its {{TransportSupport}}
only skips key/trust store loading when the location is *null* - an empty
string triggers {{new FileInputStream("")}} -> {{FileNotFoundException}} at
connect time.
h3. Failure scenarios
# Broker certificate signed by a CA in the JVM default trust store; user sets
only {{useSsl=true}} -> connection fails instead of using the default trust
store (cacerts).
# The common server-only TLS case (trust store configured, no client key store)
-> fails trying to load a key store from {{""}}.
The existing tests mask this: {{AMQPConfigTest.testEnabledSslComponent}}
literally asserts the empty parameters (URI shape only), and
{{AMQPSAuthRouteTest}} always configures both stores. Introduced by CAMEL-11780
(eb5b6ab9219f, Oct 2024).
h3. Related (same code block)
* Values are not URL-encoded: a literal {{%}}, {{&}}, {{=}} or {{#}} in a store
password/path corrupts the connection URI.
* Store passwords are embedded in plaintext in the connection factory's
{{remoteURI}} (retrievable via {{getRemoteURI()}}, part of qpid's debug-logging
surface). Consider configuring the stores through qpid's transport options API
instead of the URI.
h3. Suggested fix direction
Only append a {{transport.*}} option when the corresponding value is actually
configured, and URL-encode the values.
h3. Reproducer
Attached {{AMQPSslTransportOptionsTest.java}} (place in
{{components/camel-amqp/src/test/java/org/apache/camel/component/amqp/}}). Both
tests fail today: the rendered remote URI contains
{{transport.keyStoreLocation=&...&transport.keyStorePassword=}} /
{{transport.trustStoreLocation=}} empty options. No broker needed.
----
_This issue was researched and filed by Claude Code on behalf of [~croway]
(GitHub: Croway), as part of a deep code review of camel-jms and camel-amqp. A
failing JUnit reproducer is attached; it fails deterministically on current
main (4.22.0-SNAPSHOT)._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
