shashank created CAMEL-25841:
--------------------------------
Summary: camel-xmpp - two endpoints that differ only in the
participant or the user are the same endpoint, so messages go to the wrong
participant or from the wrong account
Key: CAMEL-25841
URL: https://issues.apache.org/jira/browse/CAMEL-25841
Project: Camel
Issue Type: Bug
Components: camel-xmpp
Reporter: shashank
Assignee: shashank
{{XmppComponent.createEndpoint}} (main 20cdb309f7d0) keeps the endpoints it
creates in a map and returns a cached endpoint for any URI with the same key.
The key is built from the scheme, host, port and query only:
{code:java}
private String extractCacheKeyFromUri(String uri) throws URISyntaxException {
URI u = new URI(uri);
return u.getScheme() + "://" + u.getHost() + u.getPort() + u.getQuery();
}
{code}
The participant (the path) and the user (the user info) are not in the key. So
{{xmpp://alice@host:5222/bob@host?password=x}} and
{{xmpp://alice@host:5222/carol@host?password=x}} resolve to the same endpoint,
the one for bob, and every message sent to the second URI goes to bob. With two
users on the same server ({{xmpp://alice@host/...}} and
{{xmpp://dave@host/...}}, same query), the second URI gets the first user's
endpoint, so messages are sent from alice's account with alice's password. This
happens with plain {{to}} endpoints in two routes as well as with toD and a
participant taken from the message, and nothing in the logs shows it (the
endpoint is only logged at DEBUG as "Using cached endpoint"). The map is also a
plain HashMap that toD can use from several threads, and it keeps every
endpoint until the component stops.
*Fix*: remove the component's endpoint cache. The component creates a new
endpoint for each URI, like other components. The CamelContext already reuses
the endpoint of the same URI and stops the endpoints it holds, so the cache is
not needed for clean-up.
*Tests*: new {{XmppComponentEndpointPerUriTest}} (3 tests, no XMPP server
needed). {{endpointPerParticipant}} fails on main: {{expected:
<carol@localhost> but was: <bob@localhost>}}. {{endpointPerUser}} fails on
main: {{expected: <dave> but was: <alice>}}. {{sameUriSameEndpoint}} passes on
main and with the fix. camel-xmpp unit tests with the fix: 12 run, 0 failures,
5 skipped (the tests that need an XMPP server container); the integration tests
were not run.
*How it was found*: a sweep for components that keep endpoints or clients in
their own maps (state that grows per endpoint and outlives it), then the JUnit
test above.
*Affected*: main, camel-4.23.x, camel-4.22.x, camel-4.18.x, camel-4.14.x and
camel-4.10.x (the same cache key; read, not run).
_Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
