[
https://issues.apache.org/jira/browse/CAMEL-24296?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18102695#comment-18102695
]
Andrea Cosentino commented on CAMEL-24296:
------------------------------------------
Doc follow-up https://github.com/apache/camel/pull/25401 adds the upgrade-guide
note (requested in review) about setObjectInputFilter() throwing
IllegalStateException after the 2-arg constructor; it was left behind by
fork-head sync lag when #25378 merged.
> camel-core: allow configuring a JEP-290 ObjectInputFilter on
> CamelObjectInputStream
> -----------------------------------------------------------------------------------
>
> Key: CAMEL-24296
> URL: https://issues.apache.org/jira/browse/CAMEL-24296
> Project: Camel
> Issue Type: Improvement
> Components: camel-core
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.22.0
>
>
> CamelObjectInputStream (camel-support) overrides resolveClass to swap the
> classloader but installs no java.io.ObjectInputFilter. As the shared helper
> used by downstream deserialisation consumers (SerializationDataFormat,
> aggregation repositories, JMS), it would benefit from an optional
> CamelContext-configurable allow-list installed via setObjectInputFilter(), so
> every downstream caller inherits it. Defensive hardening; must default to
> non-restrictive behaviour to preserve compatibility.
> _Filed by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
