Andrea Cosentino created CAMEL-24370:
----------------------------------------
Summary: camel-netty - resolve the shared deserialization filter
in the object codecs and expose deserializationFilter on the endpoint
Key: CAMEL-24370
URL: https://issues.apache.org/jira/browse/CAMEL-24370
Project: Camel
Issue Type: Improvement
Components: camel-netty
Reporter: Andrea Cosentino
h3. Background
The camel-netty object codecs are the last Java-serialization entry points in
the component tree that do not resolve their {{ObjectInputFilter}} through the
shared {{DeserializationFilterHelper}} introduced in CAMEL-23815.
h3. Current state
* {{org.apache.camel.component.netty.codec.ObjectDecoder}} sets an
{{ObjectInputFilter}} only when the {{deserializationFilter}} constructor
argument is non-null. The single-argument constructor passes {{null}}, so
decoders built that way apply no filter at all and only emit a WARN log.
* {{org.apache.camel.component.netty.codec.DatagramPacketObjectDecoder}}
inherits the same behaviour by delegation.
* Within the same component, {{NettyConverter}} already calls
{{DeserializationFilterHelper.resolveDeserializationFilter(null)}}, so the
type-converter path and the codec path behave inconsistently.
* The netty endpoint exposes no {{deserializationFilter}} option, while
camel-netty-http and twelve other components do.
h3. Proposed change
# Resolve the filter in {{ObjectDecoder}} through
{{DeserializationFilterHelper.resolveDeserializationFilter(...)}}, so that an
unset pattern falls back to the JVM-wide {{jdk.serialFilter}} and then to the
shared Camel default instead of applying no filter.
# Add a {{deserializationFilter}} option on the netty component and endpoint
for parity with camel-netty-http, and thread it through to the codecs.
# Document the option and the recommended setting for routes that use the
{{ObjectEncoder}} / {{ObjectDecoder}} pair in {{netty-component.adoc}}.
h3. Compatibility
This is a behaviour change for existing routes that wire {{ObjectDecoder}}
explicitly: classes outside the default allow-list will start to be rejected.
It needs an entry in
{{docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc}}.
h3. Related
CAMEL-23297 added the {{deserializationFilter}} argument to these codecs,
CAMEL-23815 introduced the shared helper, and CAMEL-24296 applied the same
default to {{CamelObjectInputStream}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
