[
https://issues.apache.org/jira/browse/CAMEL-24576?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18110192#comment-18110192
]
Andrea Cosentino commented on CAMEL-24576:
------------------------------------------
PR opened: https://github.com/apache/camel/pull/25992
Adds {{allowPredicateFromMessage}} (default false, {{security =
"insecure:dev"}}) to the dynamic-router-control endpoint, keeps the flag on the
optimised static URI so that {{toD}} cannot strip it and a message can never
set it, falls back to the endpoint configuration for subscription parameters
the message does not carry, and wires {{allowedSchemes}} into the RecipientList
built by DynamicRouterRecipientListHelper. Documented on both component pages
and in the 4.23 upgrade guide.
{{mvn verify}} on components/camel-dynamic-router is green (134 unit tests, 21
integration tests), and a full reactor build passed.
_Claude Code on behalf of oscerd_
> camel-dynamic-router: align control endpoint parameter handling with the
> allowTemplateFromHeader convention
> -----------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24576
> URL: https://issues.apache.org/jira/browse/CAMEL-24576
> Project: Camel
> Issue Type: Improvement
> Components: camel-core
> Affects Versions: 4.4.0
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
>
> The {{dynamic-router-control}} producer builds subscriptions entirely from
> values carried on the incoming message.
> {{DynamicRouterControlProducer.subscribeFromMessage}} and
> {{subscribeFromHeaders}} read {{subscribeChannel}}, {{subscriptionId}},
> {{destinationUri}}, {{priority}}, {{predicate}}, {{predicateBean}} and
> {{expressionLanguage}} from the message body or headers, and
> {{DynamicRouterControlService.obtainPredicateFromExpression}} then resolves
> whichever language the message names and compiles the supplied expression
> into a filter that is retained in the channel's rule base.
> Elsewhere in Camel, taking a template or script from the message is an
> explicit opt-in that defaults to off -- {{allowTemplateFromHeader}} on
> {{camel-language}} and on the {{ResourceEndpoint}}-based template components.
> The control endpoint has no equivalent option, so there is no way for a route
> author to express that subscription parameters should come from the endpoint
> configuration rather than from message content.
> Two related gaps in the same code path:
> * {{DynamicRouterRecipientListHelper.createProcessor}} builds the component's
> {{RecipientList}} without calling {{setAllowedSchemes}}, and
> {{DynamicRouterConfiguration}} exposes no such option, so the scheme
> allowlist added for the recipientList/toD family in CAMEL-24298 does not
> apply to {{destinationUri}} here.
> * {{subscribeFromHeaders}} never falls back to the endpoint {{configuration}}
> for any parameter. The documented URI-parameter form only takes effect
> through {{toD}}, where {{DynamicRouterControlChannelSendDynamicAware}}
> converts the parameters into the same headers. No test covers a static
> {{.to("dynamic-router-control:subscribe?predicate=...")}} end to end.
> Proposed change:
> # Add an endpoint/component option, defaulting to {{false}}, controlling
> whether the predicate expression and its language may be taken from the
> message. Mark it {{security = "insecure:dev"}} per the project's annotation
> convention.
> # When the option is {{false}}, source those parameters from the endpoint
> configuration, so that the documented static-URI form works and the {{toD}}
> form keeps working.
> # Expose an {{allowedSchemes}} option on {{DynamicRouterConfiguration}} and
> wire it into the recipient list built by {{DynamicRouterRecipientListHelper}}.
> # Add tests for both the gated and ungated paths, including a static
> {{.to(...)}} subscription, and document the new options.
> _Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
