Federico Mariani created CAMEL-24117:
----------------------------------------
Summary: camel-rest-openapi: one strategy instance shared by all
consumers - missingOperation/mockIncludePattern cross-talk, second consumer can
silently disable fail-fast validation
Key: CAMEL-24117
URL: https://issues.apache.org/jira/browse/CAMEL-24117
Project: Camel
Issue Type: Bug
Components: camel-rest-openapi
Affects Versions: 4.21.0
Reporter: Federico Mariani
h3. Problem
{{RestOpenApiComponent.doInit}} creates ONE
{{DefaultRestOpenapiProcessorStrategy}} and {{createEndpoint}} hands the same
instance to every endpoint (RestOpenApiComponent.java:181, 199-202). Each
consumer's {{afterPropertiesConfigured}} then calls
{{strategy.setMissingOperation(endpoint.getMissingOperation())}} and
{{setMockIncludePattern(...)}} on the shared object
(RestOpenApiProcessor.java:218-220) - the last consumer initialized wins for
all.
Worse: the endpoint field {{missingOperation}} defaults to {{null}} (the
{{@UriParam defaultValue="fail"}} is doc-only), and the strategy's null ->
fail/mock resolution in {{doInit}}
(DefaultRestOpenapiProcessorStrategy.java:429-437) runs only once because
{{ServiceHelper.initService}} is idempotent. With two consumers, consumer A
inits -> strategy resolves {{fail}}; consumer B's {{setMissingOperation(null)}}
resets it to {{null}} and {{initService}} is a no-op -> {{validateOpenApi}}
matches none of the fail/ignore/mock branches: unmapped operations are silently
accepted (fail-fast lost) and unmapped requests hit a consumer-less direct
endpoint -> HTTP 500 at runtime. The strategy's {{uris}} list also mixes both
consumers' paths, so {{doStop}} would deregister the other consumer's endpoints.
h3. Failure scenario
Two {{rest().openApi()}} blocks in one application - any combination of
default/mock/fail -> at least one consumer runs with the wrong missingOperation
mode.
h3. Fix direction
Create a strategy instance per endpoint (share only an explicitly user-supplied
custom strategy), or move {{missingOperation}}/{{mockIncludePattern}}/{{uris}}
into per-consumer state passed to the strategy methods.
----
_This issue was researched and filed by Claude Code on behalf of [~croway]
(GitHub: Croway), as part of a deep code review of camel-rest-openapi and
camel-openapi-java on main (4.22.0-SNAPSHOT). Full findings document available
on request._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
