[
https://issues.apache.org/jira/browse/CAMEL-24503?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino updated CAMEL-24503:
-------------------------------------
Fix Version/s: 4.23.0
> camel-spring-boot - security policy check does not see camel properties
> supplied as environment variables
> ---------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24503
> URL: https://issues.apache.org/jira/browse/CAMEL-24503
> Project: Camel
> Issue Type: Improvement
> Components: camel-spring-boot
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.23.0
>
>
> {{CamelSecurityPolicyAutoConfiguration.extractCamelProperties()}} collects
> the properties the {{camel.security}} policy framework (CAMEL-23250)
> evaluates:
> {code:java}
> for (String name : eps.getPropertyNames()) {
> if (name != null && name.startsWith("camel.") &&
> !name.startsWith("camel.security.")) {
> Object value = environment.getProperty(name);
> {code}
> (CamelSecurityPolicyAutoConfiguration:114)
> The filter is a raw string comparison on the name as the property source
> reports it. The {{systemEnvironment}} source reports environment variables in
> their native form - {{CAMEL_COMPONENT_FOO_BAR}} - which never matches the
> {{camel.}} prefix. Any Camel option configured through the environment is
> therefore invisible to the policy check, even though Spring's relaxed binding
> will happily apply it to the component.
> This matters for containerised deployments, where environment variables are
> the usual way to configure a Camel application.
> *Proposal*
> Canonicalise names before filtering - run them through
> {{ConfigurationPropertyName}} / relaxed-binding conversion so the {{CAMEL_*}}
> forms normalise to {{camel.*}} - or bind the security-relevant prefixes with
> {{Binder}}, which applies relaxed binding itself, instead of string-matching
> on source names.
> A test setting a policy-relevant option via
> {{EnvironmentVariablesPropertySource}} and asserting the policy still reports
> it would cover the gap.
> ----
> _This issue was drafted by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
