Andrea Cosentino created CAMEL-24676:
----------------------------------------
Summary: camel-jgroups: add a configurable deserialization filter
and document serialization hardening for the consumer
Key: CAMEL-24676
URL: https://issues.apache.org/jira/browse/CAMEL-24676
Project: Camel
Issue Type: Improvement
Components: camel-jgroups
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
The camel-jgroups consumer maps an incoming cluster message to the exchange
body by calling {{org.jgroups.Message.getObject()}}, which returns the Java
object carried by the message ({{JGroupsEndpoint.createExchange(Message)}}).
Unlike the other Camel components that can receive Java-serialized payloads
(the camel-netty and camel-mina object codecs, camel-jms
{{objectMessageEnabled}}, camel-spring-redis), camel-jgroups currently exposes
no way to constrain the types it accepts from the cluster, and its
documentation does not describe the serialization trust boundary of a JGroups
cluster.
This is a consistency / hardening task to bring camel-jgroups in line with the
shared deserialization-filter work:
* Add a configurable {{deserializationFilter}} option on the
consumer/component, resolved through the shared
{{org.apache.camel.support.DeserializationFilterHelper}} (CAMEL-23815 /
CAMEL-24296), so an application can restrict the classes accepted from the
cluster to an allow-list.
* Apply the resolved filter as a class check on the message body before it is
routed downstream.
* Add a Security section to the camel-jgroups component documentation
explaining that message bodies are Java-deserialized, that the default protocol
stack does not authenticate peers, and recommending the effective hardening
levers: a JVM-wide {{jdk.serialFilter}}, and configuring the {{JChannel}} with
authentication ({{AUTH}}) and encryption ({{SYM_ENCRYPT}} / {{ASYM_ENCRYPT}})
via {{channelProperties}}.
Note: JGroups performs object deserialization inside its own receive path, so
the JVM-wide {{jdk.serialFilter}} together with channel-level authentication
and encryption are the primary mitigations. The component-level
{{deserializationFilter}} is a defense-in-depth allow-list for the message body
and is documented as such.
Related hardening: CAMEL-24296, CAMEL-24370, CAMEL-24421, CAMEL-24509.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
