Andrea Cosentino created CAMEL-24503:
----------------------------------------
Summary: camel-spring-boot - security policy check does not see
camel properties supplied as environment variables
Key: CAMEL-24503
URL: https://issues.apache.org/jira/browse/CAMEL-24503
Project: Camel
Issue Type: Improvement
Components: camel-spring-boot
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
{{CamelSecurityPolicyAutoConfiguration.extractCamelProperties()}} collects the
properties the {{camel.security}} policy framework (CAMEL-23250) evaluates:
{code:java}
for (String name : eps.getPropertyNames()) {
if (name != null && name.startsWith("camel.") &&
!name.startsWith("camel.security.")) {
Object value = environment.getProperty(name);
{code}
(CamelSecurityPolicyAutoConfiguration:114)
The filter is a raw string comparison on the name as the property source
reports it. The {{systemEnvironment}} source reports environment variables in
their native form - {{CAMEL_COMPONENT_FOO_BAR}} - which never matches the
{{camel.}} prefix. Any Camel option configured through the environment is
therefore invisible to the policy check, even though Spring's relaxed binding
will happily apply it to the component.
This matters for containerised deployments, where environment variables are the
usual way to configure a Camel application.
*Proposal*
Canonicalise names before filtering - run them through
{{ConfigurationPropertyName}} / relaxed-binding conversion so the {{CAMEL_*}}
forms normalise to {{camel.*}} - or bind the security-relevant prefixes with
{{Binder}}, which applies relaxed binding itself, instead of string-matching on
source names.
A test setting a policy-relevant option via
{{EnvironmentVariablesPropertySource}} and asserting the policy still reports
it would cover the gap.
----
_This issue was drafted by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
