[
https://issues.apache.org/jira/browse/CAMEL-24725?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino reassigned CAMEL-24725:
----------------------------------------
Assignee: Andrea Cosentino
> core: apply the shared deserialization filter in KeyValueRepositoryHelper
> -------------------------------------------------------------------------
>
> Key: CAMEL-24725
> URL: https://issues.apache.org/jira/browse/CAMEL-24725
> Project: Camel
> Issue Type: Improvement
> Components: camel-core
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
>
> {{KeyValueRepositoryHelper}} was added in 4.23 (CAMEL-24463) to centralise
> the Java serialization used by the persistent {{KeyValueRepository}}
> implementations. Its two {{deserialize(...)}} overloads create a plain
> {{ObjectInputStream}} and call {{readObject()}} without installing an
> {{ObjectInputFilter}}:
> *
> {{core/camel-support/src/main/java/org/apache/camel/support/KeyValueRepositoryHelper.java}},
> lines 84-91 and 103-110
> This is inconsistent with the rest of the codebase. Camel already has a
> shared helper for exactly this, {{DeserializationFilterHelper}} (added in
> 4.22), and every other {{ObjectInputStream}} call site in main source either
> goes through it or installs an equivalent filter:
> * camel-mina {{MinaConverter}}
> * camel-netty {{NettyConverter}}, {{ObjectDecoder}}
> * camel-netty-http {{NettyHttpHelper}}
> * camel-vertx-http {{VertxHttpHelper}}
> * camel-http-common {{HttpHelper}}
> * camel-jms and camel-sjms {{JmsBinding}}
> * camel-spring-redis {{FilteringDeserializer}}
> * camel-consul {{ConsulRegistry}}
> * camel-infinispan {{DefaultExchangeHolderUtils}}
> * camel-pqc {{FileBasedKeyLifecycleManager}}
> * the Cassandra and JDBC aggregation repository codecs
> ({{CassandraCamelCodec}}, {{JdbcCamelCodec}})
> The KeyValue repositories are the only remaining group without it, so the
> filtering that the aggregation repositories apply is not applied by their
> KeyValue counterparts. Affected components: camel-cassandraql,
> camel-hazelcast, camel-infinispan, camel-jpa, camel-kafka,
> camel-spring-redis, camel-sql.
> h3. Proposed change
> Install the shared filter in both {{deserialize}} overloads:
> {code:java}
> ObjectInputStream ois = new ObjectInputStream(bis);
> ois.setObjectInputFilter(DeserializationFilterHelper.resolveDeserializationFilter(null));
> {code}
> {{DeserializationFilterHelper.resolveDeserializationFilter}} already honours
> an explicitly configured pattern first, then the JVM-wide
> {{jdk.serialFilter}}, then the conservative Camel default - so this keeps
> behaviour consistent with every other component and stays configurable.
> Optionally, expose a {{deserializationFilter}} option on the KeyValue
> repositories, mirroring the option the JMS/HTTP/Netty components already
> provide, so the allow-list can be narrowed per repository.
> The class Javadoc should also be updated - it currently states that the
> stored data is trusted.
> h3. Notes
> {{KeyValueRepositoryHelper}} is {{@since 4.23}} and is not present on
> {{camel-4.22.x}} or {{camel-4.18.x}}, so this only needs to land on {{main}}
> before 4.23.0 is released. No backport required.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
