Andrea Cosentino created CAMEL-24725:
----------------------------------------
Summary: core: apply the shared deserialization filter in
KeyValueRepositoryHelper
Key: CAMEL-24725
URL: https://issues.apache.org/jira/browse/CAMEL-24725
Project: Camel
Issue Type: Improvement
Components: camel-core
Reporter: Andrea Cosentino
{{KeyValueRepositoryHelper}} was added in 4.23 (CAMEL-24463) to centralise the
Java serialization used by the persistent {{KeyValueRepository}}
implementations. Its two {{deserialize(...)}} overloads create a plain
{{ObjectInputStream}} and call {{readObject()}} without installing an
{{ObjectInputFilter}}:
*
{{core/camel-support/src/main/java/org/apache/camel/support/KeyValueRepositoryHelper.java}},
lines 84-91 and 103-110
This is inconsistent with the rest of the codebase. Camel already has a shared
helper for exactly this, {{DeserializationFilterHelper}} (added in 4.22), and
every other {{ObjectInputStream}} call site in main source either goes through
it or installs an equivalent filter:
* camel-mina {{MinaConverter}}
* camel-netty {{NettyConverter}}, {{ObjectDecoder}}
* camel-netty-http {{NettyHttpHelper}}
* camel-vertx-http {{VertxHttpHelper}}
* camel-http-common {{HttpHelper}}
* camel-jms and camel-sjms {{JmsBinding}}
* camel-spring-redis {{FilteringDeserializer}}
* camel-consul {{ConsulRegistry}}
* camel-infinispan {{DefaultExchangeHolderUtils}}
* camel-pqc {{FileBasedKeyLifecycleManager}}
* the Cassandra and JDBC aggregation repository codecs
({{CassandraCamelCodec}}, {{JdbcCamelCodec}})
The KeyValue repositories are the only remaining group without it, so the
filtering that the aggregation repositories apply is not applied by their
KeyValue counterparts. Affected components: camel-cassandraql, camel-hazelcast,
camel-infinispan, camel-jpa, camel-kafka, camel-spring-redis, camel-sql.
h3. Proposed change
Install the shared filter in both {{deserialize}} overloads:
{code:java}
ObjectInputStream ois = new ObjectInputStream(bis);
ois.setObjectInputFilter(DeserializationFilterHelper.resolveDeserializationFilter(null));
{code}
{{DeserializationFilterHelper.resolveDeserializationFilter}} already honours an
explicitly configured pattern first, then the JVM-wide {{jdk.serialFilter}},
then the conservative Camel default - so this keeps behaviour consistent with
every other component and stays configurable.
Optionally, expose a {{deserializationFilter}} option on the KeyValue
repositories, mirroring the option the JMS/HTTP/Netty components already
provide, so the allow-list can be narrowed per repository.
The class Javadoc should also be updated - it currently states that the stored
data is trusted.
h3. Notes
{{KeyValueRepositoryHelper}} is {{@since 4.23}} and is not present on
{{camel-4.22.x}} or {{camel-4.18.x}}, so this only needs to land on {{main}}
before 4.23.0 is released. No backport required.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
