[
https://issues.apache.org/jira/browse/CAMEL-24613?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18111167#comment-18111167
]
Andrea Cosentino commented on CAMEL-24613:
------------------------------------------
Fixed in https://github.com/apache/camel/pull/26081 (merged to main, 4.23.0).
The parseGuardrailClasses interface-check item was withdrawn (see prior
comment).
_Claude Code on behalf of oscerd_
> camel-langchain4j-agent-api: guardrail robustness (English false-reject with
> allowMixed=false, no guardrail-class interface check)
> ----------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24613
> URL: https://issues.apache.org/jira/browse/CAMEL-24613
> Project: Camel
> Issue Type: Bug
> Components: camel-langchain4j-agent
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> Two low-severity robustness issues in the agent-api guardrails:
> 1. LanguageGuardrail with allowMixed(false) and allowedLanguages={ENGLISH}
> falsely rejects plain English. The ENGLISH and LATIN_SCRIPT enum patterns
> overlap (ASCII letters match both), so detectedLanguages ends up {ENGLISH,
> LATIN_SCRIPT}; the mixed-content check then treats LATIN_SCRIPT as 'not
> allowed and not ENGLISH' and fails with 'Mixed language content is not
> allowed.'. Only in the non-default allowMixed(false) configuration. Fix:
> treat LATIN_SCRIPT as satisfied when ENGLISH is allowed (or de-overlap the
> patterns) before the mixed-content check.
> 2. AgentConfiguration.parseGuardrailClasses loads class names via
> Class.forName with no check that the class implements
> InputGuardrail/OutputGuardrail; a wrong or unrelated class name is silently
> accepted and only fails deep inside langchain4j later. The single shared
> parse method also cannot distinguish input vs output, so an output-guardrail
> name given to the input list is accepted. Fix: validate the loaded class
> against the expected guardrail interface and log/skip mismatches (as it
> already does for ClassNotFoundException).
> _Reported by an automated functional audit._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
