Claus Ibsen created CAMEL-24578:
-----------------------------------
Summary: camel-avro-rpc fails with Avro 1.12.2 due to new
ClassSecurityValidator rejecting HandshakeRequest
Key: CAMEL-24578
URL: https://issues.apache.org/jira/browse/CAMEL-24578
Project: Camel
Issue Type: Bug
Components: camel-avro
Reporter: Claus Ibsen
Bumping Avro from 1.12.1 to 1.12.2 (see PR #25971, a Dependabot dependency
bump) breaks camel-avro-rpc's test suite on the Java 25 build. Avro 1.12.2
introduced a new schema-class security check
(org.apache.avro.util.ClassSecurityValidator) that rejects any class referenced
in an Avro schema unless it is explicitly trusted via the
org.apache.avro.SERIALIZABLE_CLASSES / org.apache.avro.SERIALIZABLE_PACKAGES
system properties, or the ClassSecurityValidator API.
camel-avro-rpc's Netty/Jetty RPC producer and consumer tests build handshake
protocols that reference org.apache.avro.ipc.HandshakeRequest, which is not on
Avro's default trust list. This fails 61 of 64 tests in
camel-avro-rpc-component with:
{noformat}
Security Forbidden org.apache.avro.ipc.HandshakeRequest! This class is not
trusted to be
included in Avro schemas. You may either use the system properties
org.apache.avro.SERIALIZABLE_CLASSES and org.apache.avro.SERIALIZABLE_PACKAGES
to set the
comma separated list of the classes or packages you trust, or you can set them
via the API
(see org.apache.avro.util.ClassSecurityValidator).
{noformat}
Affected tests include AvroNettyProducerTest, AvroNettySpringProducerTest,
AvroNettySpringConsumerTest, and others, all failing at initializeServer()
during handshake setup.
The camel-avro module's own surefire run also failed in the same CI build
(components/camel-avro/target/surefire-reports), likely for the same underlying
reason, though the detailed per-test output wasn't captured in the console log
for that module.
Proposal: camel-avro-rpc (and camel-avro, if affected) should configure a
trusted class/package allowlist for the Avro classes/packages it legitimately
needs at runtime (e.g., org.apache.avro.ipc.*) rather than leaving this
unconfigured and broken. This likely means setting
org.apache.avro.SERIALIZABLE_PACKAGES (or using ClassSecurityValidator
programmatically) somewhere in the component's initialization, and
documenting/exposing it as a URI option if users need to trust their own custom
classes for RPC payloads.
Reference: PR #25971 (Dependabot bump 1.12.1 -> 1.12.2) CI run:
https://github.com/apache/camel/actions/runs/33479975446/job/99767198741
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
