Andrea Cosentino created CAMEL-24756:
----------------------------------------
Summary: camel-base-engine - http: resources are resolved with no
connect or read timeout
Key: CAMEL-24756
URL: https://issues.apache.org/jira/browse/CAMEL-24756
Project: Camel
Issue Type: Improvement
Reporter: Andrea Cosentino
h2. Problem
{{DefaultResourceResolvers.HttpResource}} opens an {{http:}} resource with no
timeouts at all:
{code:java}
@Override
public InputStream getInputStream() throws IOException {
URLConnection con = URI.create(getLocation()).toURL().openConnection();
con.setUseCaches(false);
try {
setContentType(con.getContentType());
return con.getInputStream();
...
{code}
{{exists()}} does the same. Neither calls {{setConnectTimeout}} or
{{setReadTimeout}}, and the JDK default for both is {{0}} - wait indefinitely.
Every component that resolves a resource through {{ResourceHelper}} with an
{{http:}} location inherits this: camel-groovy, camel-velocity, camel-xslt,
camel-opa's {{policyBundle}}, and the rest.
h2. Why it matters
Resource resolution usually happens in {{doStart()}}, which runs on the
bootstrap thread. A slow or black-holed HTTP server therefore does not fail the
one route - it stalls {{CamelContext}} startup, with no log line saying what it
is waiting for and no way to bound it short of killing the process.
A refused connection fails fast, so this only shows up against a host that
accepts and then does not answer - which is exactly the case an operator cannot
reproduce locally.
h2. Proposal
Set a connect and read timeout on the {{URLConnection}} in both
{{getInputStream()}} and {{exists()}}, with a sensible default (30s is the
convention elsewhere in Camel) and a way to override it - a property on the
resource loader, or {{camel.main.*}} configuration, so a deployment fetching a
large artifact over a slow link can raise it.
Care is needed not to break the streaming contract: {{getInputStream()}}
returns the stream to the caller, so a read timeout applies to the whole read,
not just the handshake.
h2. Scope
{{camel-base-engine}}. Behaviour change from "wait forever" to "fail after N
seconds", so it wants an upgrade-guide entry.
Raised by the review bot on https://github.com/apache/camel/pull/26445, where
{{camel-opa}}'s {{policyBundle}} can be an {{http:}} location; documented there
as a caveat, but the fix belongs here.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
