[
https://issues.apache.org/jira/browse/CAMEL-24292?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18115490#comment-18115490
]
Andrea Cosentino commented on CAMEL-24292:
------------------------------------------
Fixed via #26268 (squash-merged to main, milestone 4.23.0):
https://github.com/apache/camel/pull/26268 (commit 6daeefed7220). Gated
CamelSqlQuery / CamelSqlStoredTemplate behind allowQueryFromHeader /
allowTemplateFromHeader (endpoint + component, default false,
security=insecure:dev), and stopped resolving header- or body-supplied
stored-procedure templates as file:/http:/classpath: resources (placeholders
only). Observability follow-up tracked in CAMEL-24718; the camel-xslt
CamelXsltFileName gate is deferred (camel-xj entanglement).
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
> camel-sql, camel-sql-stored and camel-xslt: add opt-in gate for override
> headers for parity with sibling components
> -------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24292
> URL: https://issues.apache.org/jira/browse/CAMEL-24292
> Project: Camel
> Issue Type: Improvement
> Components: camel-sql, camel-xslt
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.23.0
>
>
> Components that let a message header override the endpoint-configured
> template/query expose an explicit opt-in flag (allowTemplateFromHeader /
> allowControlHeaders, default false). A few read their override header
> unconditionally:
> - camel-sql: SqlProducer reads CamelSqlQuery ungated -> add
> allowQueryFromHeader on DefaultSqlEndpoint.
> - camel-sql-stored: SqlStoredProducer reads CamelSqlStoredTemplate ungated;
> the value additionally flows through SqlHelper.resolveQuery -> ResourceHelper
> (which resolves file:/http: schemes) -> add a gate and use placeholder-only
> resolution on header-derived input.
> - camel-xslt: FileResultHandlerFactory reads CamelXsltFileName ungated, while
> CamelXsltResourceUri/Stylesheet are gated by allowTemplateFromHeader -> gate
> consistently.
> Note: gating a currently-honoured header (especially CamelSqlQuery) is a
> behavioural change -> needs an upgrade-guide entry and PMC input on the
> default. Filed for discussion.
> _Filed by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
