Andrea Cosentino created CAMEL-25223:
----------------------------------------
Summary: camel-jgroups: fail fast (or require explicit opt-in)
when the consumer has no pre-read deserialization control on the default channel
Key: CAMEL-25223
URL: https://issues.apache.org/jira/browse/CAMEL-25223
Project: Camel
Issue Type: Improvement
Components: camel-jgroups
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Follow-up / hardening on top of CAMEL-24676.
CAMEL-24676 added a {{deserializationFilter}} option and a default, post-read
class check in the camel-jgroups consumer, documented as defense-in-depth. The
controls that actually take effect *before* JGroups reads the object are a
JVM-wide {{-Djdk.serialFilter}}, the JGroups-native
{{jgroups.deserialization.filter}} system property (JGroups 5.5.x+), or a
channel configured with authentication/encryption.
With the default channel ({{new JChannel()}}, i.e. no {{channelProperties}})
and none of those configured, the consumer starts silently with no pre-read
control in place and no signal to the operator.
Proposal: on consumer start, detect whether any pre-read control is in effect -
the {{deserializationFilter}} option, a JVM-wide filter
({{ObjectInputFilter.Config.getSerialFilter()}}), the
{{jgroups.deserialization.filter}} property, or an authenticated/encrypted
channel. When none is, either fail to start with a clear message pointing at
the component Security section, or require an explicit opt-in option to keep
the current permissive behaviour (mirroring how camel-jms gates object
messages).
Document the new behaviour and the {{jgroups.deserialization.filter}} property
in the component Security section and the upgrade guide (changed default / new
option).
Touch points:
- components/camel-jgroups/.../JGroupsEndpoint.java (doStart)
- components/camel-jgroups/.../JGroupsComponent.java (new option)
- components/camel-jgroups/src/main/docs/jgroups-component.adoc (+ matching
upgrade-guide entry on main)
Continues the serialization-hardening consistency work (CAMEL-24676; shared
DeserializationFilterHelper from CAMEL-23815 / CAMEL-24296).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
