Federico Mariani created CAMEL-24112:
----------------------------------------
Summary: camel-rest-openapi: path parameters leak into the query
string when the operation has more than one parameter
Key: CAMEL-24112
URL: https://issues.apache.org/jira/browse/CAMEL-24112
Project: Camel
Issue Type: Bug
Components: camel-rest-openapi
Affects Versions: 4.21.0
Reporter: Federico Mariani
h3. Problem
{{RestOpenApiEndpoint.determineEndpointParameters()}}
(RestOpenApiEndpoint.java:672-687) tries to skip endpoint URI parameters that
are operation *path* parameters, so they are not duplicated as query parameters
(CAMEL-17049). The loop is logically inverted: the entry is {{put}} into
{{nestedParameters}} *inside* the inner per-operation-parameter loop whenever
*any* operation parameter is not the clashing path parameter, instead of only
when *no* parameter clashes. The skip therefore only works when the operation
has exactly one parameter. The leaked entries become
{{RestEndpoint.parameters}}, flow into the lenient delegate HTTP endpoint, and
are appended as literal query parameters to the target URI.
h3. Failure scenario
Spec operation {{GET /users/\{userId\}/orders/\{orderId\}}} (two path params,
no query params), route
{{to("rest-openapi:spec.json#getOrder?userId=1&orderId=2")}} with the
camel-http delegate -> request sent is {{GET
/users/1/orders/2?userId=1&orderId=2}}. Verified by execution against current
main; a single-path-param operation is handled correctly. APIs with strict
query validation or signed/canonicalized URLs reject the request. When the
operation also declares query parameters the leak is masked for camel-http by
the {{Exchange.REST_HTTP_QUERY}} override, but not for other delegates.
h3. History
Introduced verbatim by commit 94847d8c4a84 (CAMEL-17049, "avoid duplicate
parameters if the param is a path param"). The intent is unambiguous; the
implementation only works for the 1-parameter case. Not pinned by tests
({{RestOpenApiEndpointV3Test.shouldDetermineEndpointParameters}} never combines
endpoint literals with multi-parameter operations).
h3. Fix direction
Compute the clash with {{operation.getParameters().stream().anyMatch(p ->
"path".equals(p.getIn()) && entry.getKey().equals(p.getName()))}} and {{put}}
once outside the inner loop. This also resolves the current asymmetry where an
*empty* (non-null) parameter list drops all endpoint literals while a {{null}}
list keeps them.
----
_This issue was researched and filed by Claude Code on behalf of [~croway]
(GitHub: Croway), as part of a deep code review of camel-rest-openapi and
camel-openapi-java on main (4.22.0-SNAPSHOT). Full findings document available
on request._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
