[
https://issues.apache.org/jira/browse/CAMEL-24117?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18096797#comment-18096797
]
Claus Ibsen commented on CAMEL-24117:
-------------------------------------
Fixed via https://github.com/apache/camel/pull/24783
> camel-rest-openapi: one strategy instance shared by all consumers -
> missingOperation/mockIncludePattern cross-talk, second consumer can silently
> disable fail-fast validation
> -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24117
> URL: https://issues.apache.org/jira/browse/CAMEL-24117
> Project: Camel
> Issue Type: Bug
> Components: camel-rest-openapi
> Affects Versions: 4.21.0
> Reporter: Federico Mariani
> Assignee: Claus Ibsen
> Priority: Major
> Labels: code-review
> Fix For: 4.22.0
>
>
> h3. Problem
> {{RestOpenApiComponent.doInit}} creates ONE
> {{DefaultRestOpenapiProcessorStrategy}} and {{createEndpoint}} hands the same
> instance to every endpoint (RestOpenApiComponent.java:181, 199-202). Each
> consumer's {{afterPropertiesConfigured}} then calls
> {{strategy.setMissingOperation(endpoint.getMissingOperation())}} and
> {{setMockIncludePattern(...)}} on the shared object
> (RestOpenApiProcessor.java:218-220) - the last consumer initialized wins for
> all.
> Worse: the endpoint field {{missingOperation}} defaults to {{null}} (the
> {{@UriParam defaultValue="fail"}} is doc-only), and the strategy's null ->
> fail/mock resolution in {{doInit}}
> (DefaultRestOpenapiProcessorStrategy.java:429-437) runs only once because
> {{ServiceHelper.initService}} is idempotent. With two consumers, consumer A
> inits -> strategy resolves {{fail}}; consumer B's
> {{setMissingOperation(null)}} resets it to {{null}} and {{initService}} is a
> no-op -> {{validateOpenApi}} matches none of the fail/ignore/mock branches:
> unmapped operations are silently accepted (fail-fast lost) and unmapped
> requests hit a consumer-less direct endpoint -> HTTP 500 at runtime. The
> strategy's {{uris}} list also mixes both consumers' paths, so {{doStop}}
> would deregister the other consumer's endpoints.
> h3. Failure scenario
> Two {{rest().openApi()}} blocks in one application - any combination of
> default/mock/fail -> at least one consumer runs with the wrong
> missingOperation mode.
> h3. Fix direction
> Create a strategy instance per endpoint (share only an explicitly
> user-supplied custom strategy), or move
> {{missingOperation}}/{{mockIncludePattern}}/{{uris}} into per-consumer state
> passed to the strategy methods.
> ----
> _This issue was researched and filed by Claude Code on behalf of [~croway]
> (GitHub: Croway), as part of a deep code review of camel-rest-openapi and
> camel-openapi-java on main (4.22.0-SNAPSHOT). Full findings document
> available on request._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
