[
https://issues.apache.org/jira/browse/CAMEL-24113?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen updated CAMEL-24113:
--------------------------------
Fix Version/s: 4.22.0
> camel-rest-openapi: producers for the same operation share one cached rest:
> delegate endpoint - produces/consumes/queryParameters cross-contamination
> between routes
> --------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24113
> URL: https://issues.apache.org/jira/browse/CAMEL-24113
> Project: Camel
> Issue Type: Bug
> Components: camel-rest-openapi
> Affects Versions: 4.21.0
> Reporter: Federico Mariani
> Assignee: Claus Ibsen
> Priority: Major
> Labels: code-review
> Fix For: 4.22.0
>
>
> h3. Problem
> {{RestOpenApiEndpoint.createProducerFor()}}
> (RestOpenApiEndpoint.java:550-557) builds the delegate URI from
> method/basePath/uriTemplate/host only, obtains it via
> {{camelContext.getEndpoint(componentEndpointUri)}} (cached by URI), then
> mutates it with {{endpoint.configureProperties(params)}} carrying
> {{produces}}, {{consumes}}, {{queryParameters}} (including endpoint-level
> literal query parameter values), {{producerComponentName}} and
> {{parameters}}. Two rest-openapi endpoints that resolve to the same
> operation/host but differ in those options alias the *same* {{RestEndpoint}}
> instance - the last {{configureProperties}} wins for both.
> {{RestProducer.prepareExchange}} reads
> {{getEndpoint().getProduces()/getConsumes()/getQueryParameters()}} at
> runtime, so the first route silently switches to the second route's
> configuration.
> h3. Failure scenario
> Two routes in one context:
> {{to("rest-openapi:petstore.json#findPetsByStatus?status=available")}} and
> {{to("rest-openapi:petstore.json#findPetsByStatus?status=sold")}}. Both
> resolve to {{rest:GET:/v3:/pet/findByStatus?host=...}} -> same cached
> endpoint; the second startup call overwrites {{queryParameters}} -> route 1
> now sends {{status=sold}}. Same for {{produces=application/json}} vs
> {{produces=application/xml}} (Content-Type of route 1 flips to XML).
> h3. History
> Pattern unchanged since the original rest-swagger component; 5133ca3e38b5
> (CAMEL-14516) only switched to configurer usage. No JIRA acknowledges the
> aliasing.
> h3. Fix direction
> Encode the distinguishing options into the {{rest:}} endpoint URI (options
> are part of the endpoint cache key), or create the delegate as a
> prototype/non-cached endpoint so each rest-openapi producer owns its own
> instance.
> ----
> _This issue was researched and filed by Claude Code on behalf of [~croway]
> (GitHub: Croway), as part of a deep code review of camel-rest-openapi and
> camel-openapi-java on main (4.22.0-SNAPSHOT). Full findings document
> available on request._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
