Andrea Cosentino created CAMEL-24576:
----------------------------------------
Summary: camel-dynamic-router: align control endpoint parameter
handling with the allowTemplateFromHeader convention
Key: CAMEL-24576
URL: https://issues.apache.org/jira/browse/CAMEL-24576
Project: Camel
Issue Type: Improvement
Components: camel-core
Affects Versions: 4.4.0
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
The {{dynamic-router-control}} producer builds subscriptions entirely from
values carried on the incoming message.
{{DynamicRouterControlProducer.subscribeFromMessage}} and
{{subscribeFromHeaders}} read {{subscribeChannel}}, {{subscriptionId}},
{{destinationUri}}, {{priority}}, {{predicate}}, {{predicateBean}} and
{{expressionLanguage}} from the message body or headers, and
{{DynamicRouterControlService.obtainPredicateFromExpression}} then resolves
whichever language the message names and compiles the supplied expression into
a filter that is retained in the channel's rule base.
Elsewhere in Camel, taking a template or script from the message is an explicit
opt-in that defaults to off -- {{allowTemplateFromHeader}} on
{{camel-language}} and on the {{ResourceEndpoint}}-based template components.
The control endpoint has no equivalent option, so there is no way for a route
author to express that subscription parameters should come from the endpoint
configuration rather than from message content.
Two related gaps in the same code path:
* {{DynamicRouterRecipientListHelper.createProcessor}} builds the component's
{{RecipientList}} without calling {{setAllowedSchemes}}, and
{{DynamicRouterConfiguration}} exposes no such option, so the scheme allowlist
added for the recipientList/toD family in CAMEL-24298 does not apply to
{{destinationUri}} here.
* {{subscribeFromHeaders}} never falls back to the endpoint {{configuration}}
for any parameter. The documented URI-parameter form only takes effect through
{{toD}}, where {{DynamicRouterControlChannelSendDynamicAware}} converts the
parameters into the same headers. No test covers a static
{{.to("dynamic-router-control:subscribe?predicate=...")}} end to end.
Proposed change:
# Add an endpoint/component option, defaulting to {{false}}, controlling
whether the predicate expression and its language may be taken from the
message. Mark it {{security = "insecure:dev"}} per the project's annotation
convention.
# When the option is {{false}}, source those parameters from the endpoint
configuration, so that the documented static-URI form works and the {{toD}}
form keeps working.
# Expose an {{allowedSchemes}} option on {{DynamicRouterConfiguration}} and
wire it into the recipient list built by {{DynamicRouterRecipientListHelper}}.
# Add tests for both the gated and ungated paths, including a static
{{.to(...)}} subscription, and document the new options.
_Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
