Andrea Cosentino created CAMEL-25409:
----------------------------------------
Summary: camel-mongodb, camel-aws2-transcribe, camel-twitter -
security metadata of three options does not match the code
Key: CAMEL-25409
URL: https://issues.apache.org/jira/browse/CAMEL-25409
Project: Camel
Issue Type: Bug
Reporter: Andrea Cosentino
A sweep of every option in the generated catalog against the security metadata
the policy framework relies on (SecurityUtils, see design/security.adoc) turned
up three options whose metadata does not match what the code does. All three
are metadata-only defects - no runtime behaviour changes, and in every case the
runtime default is the safe one - but each defeats a mechanism that is supposed
to catch misconfiguration.
*1. camel-mongodb: tlsAllowInvalidHostnames is not marked insecure:ssl*
MongoDbEndpoint#tlsAllowInvalidHostnames is declared as a plain @UriParam(label
= "security"), but setting it calls builder.invalidHostNameAllowed(true) - it
disables TLS hostname verification exactly like the options that do carry
security = "insecure:ssl" (camel-kafka sslEndpointAlgorithm via CAMEL-24056,
the AWS trustAllCertificates family, netty hostnameVerification, splunk-hec
skipTlsVerify). Because the security option map is keyed by the bare option
name, nothing named tlsAllowInvalidHostnames is known to it, so
camel.main.profile=prod does not refuse it.
*2. camel-aws2-transcribe: trustAllCertificates advertises defaultValue=true*
Transcribe2Configuration declares @UriParam(security = "insecure:ssl",
defaultValue = "true") on a bare boolean field, so the runtime default is false
while the catalog, the component documentation and the generated DSL builders
all say the default is true. Every other AWS component declares defaultValue =
"false". The option itself is live (consumed by AwsClientBuilderUtil), so this
is purely wrong advertised metadata - but it tells users that an AWS component
ships trusting all certificates.
*3. camel-twitter: component-level httpProxyPassword is not marked as a secret*
AbstractTwitterComponent#httpProxyPassword has @Metadata(label = "proxy") with
no security = "secret", while the endpoint-level twin in TwitterConfiguration
has it. The catalog therefore reports secret=true for the endpoint option and
secret=false for the component property of the same name, for
twitter-directmessage, twitter-search and twitter-timeline. Sanitized URIs
still mask it through SensitiveUtils, but the plain-text-secret check and UI
masking skip the component-level property.
*Follow-up, not included here*
camel-debezium-mongodb has the same gap as (1) on
mongodbSslInvalidHostnameAllowed, but that configuration class is generated by
camel-debezium-maven-plugin, so fixing it means teaching
ConnectorConfigGenerator about security-sensitive option names and regenerating
every connector. That is worth a separate issue rather than being folded in
here.
_Reported by Claude Code on behalf of @oscerd_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
