[
https://issues.apache.org/jira/browse/CAMEL-24718?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18117835#comment-18117835
]
Claus Ibsen commented on CAMEL-24718:
-------------------------------------
Merged in https://github.com/apache/camel/pull/26689 (commit a6bc7c254143) for
4.23.0.
_Claude Code on behalf of davsclaus_
> camel-sql - observability (SqlTraceDevConsole, SqlSpanDecorator) surfaces the
> CamelSqlQuery header even when allowQueryFromHeader is disabled
> ---------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24718
> URL: https://issues.apache.org/jira/browse/CAMEL-24718
> Project: Camel
> Issue Type: Bug
> Components: camel-sql
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.23.0
>
>
> Follow-up to CAMEL-24292.
> CAMEL-24292 gates the CamelSqlQuery header behind a new allowQueryFromHeader
> option (default false), so by default a message carrying CamelSqlQuery no
> longer changes the executed SQL. However, three observability sites still
> read that header unconditionally and prefer/tag it, so with the gate off they
> display or trace a statement that was never executed:
> * core/camel-console - SqlTraceDevConsole (around line 276-281): the comment
> reads "prefer the CamelSqlQuery header (runtime override) over the URI" and
> it reports the header value as the executed query. This console also handles
> jdbc:, so it cannot simply drop the header - it must consult the owning
> endpoint's allowQueryFromHeader flag.
> * components/camel-telemetry - SqlSpanDecorator (line 43-45): writes the
> header to the DB_STATEMENT span tag.
> * components/camel-tracing - SqlSpanDecorator (line 44-46): same.
> Beyond being misleading, the telemetry/tracing decorators place
> attacker-controlled header text into span tags for a query that was rejected.
> Fix: gate each read on the endpoint's allowQueryFromHeader so the header
> value is only surfaced when the override is actually enabled (and therefore
> actually executed).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
