[
https://issues.apache.org/jira/browse/CAMEL-25226?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen resolved CAMEL-25226.
---------------------------------
Resolution: Fixed
> camel-fory: requireClassRegistration option missing
> security="insecure:serialization" annotation
> ------------------------------------------------------------------------------------------------
>
> Key: CAMEL-25226
> URL: https://issues.apache.org/jira/browse/CAMEL-25226
> Project: Camel
> Issue Type: Task
> Components: camel-fory
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.23.0
>
>
> The +requireClassRegistration+ option in +ForyDataFormat+ controls whether
> Apache Fory enforces class allowlisting during deserialization. When set to
> +false+, Fory will deserialize any class present in the wire payload (unsafe
> deserialization).
> Every other component that exposes a similar unsafe-deserialization opt-in
> (30+ components: camel-avro, camel-jms, camel-netty, camel-mina, etc.)
> carries the +@Metadata(security = "insecure:serialization")+ annotation. This
> annotation enables the Camel security policy framework
> (+camel.main.profile=prod+) to detect and reject this unsafe configuration at
> startup.
> The +requireClassRegistration+ field in +ForyDataFormat+ is missing this
> annotation. Default value is +true+ (safe), so this is an
> annotation/hardening gap rather than a default exposure.
> *Fix:* Add +@Metadata(label = "security", security =
> "insecure:serialization", insecureValue = "false")+ to the
> +requireClassRegistration+ field and regenerate component metadata.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
