shashank created CAMEL-25949:
--------------------------------
Summary: camel-graphql - the producer sends the queryHeader and
variablesHeader headers as HTTP headers, and a Content-Type of the message
replaces application/json
Key: CAMEL-25949
URL: https://issues.apache.org/jira/browse/CAMEL-25949
Project: Camel
Issue Type: Bug
Components: camel-graphql
Reporter: shashank
Assignee: shashank
{{GraphqlProducer}} sends its request through an internal camel-http endpoint
since CAMEL-22562 (4.19). It copies all headers of the message to the internal
exchange ({{MessageHelper.copyHeaders(exchange.getMessage(),
httpExchange.getIn(), true)}}, main 9f839f4bcc9d), and camel-http sends every
header that its {{HttpHeaderFilterStrategy}} lets through as an HTTP header. So:
* the header named by {{queryHeader}} is sent as an HTTP header, with the whole
query as its value, next to the same query in the JSON body. A query longer
than the request header limit of the server fails (Jetty, Tomcat and Spring
Boot accept 8 KB of request headers by default). A route with
{{queryHeader=myQuery}} and a query of 10,000 characters gets
{{HttpOperationFailedException ... statusCode: 431}} from a server with that
limit;
* the header named by {{variablesHeader}} (a {{JsonObject}}) is sent as an HTTP
header as well, so the variables of every request (which can hold personal data
or large values) also end up in a request header;
* the {{Content-Type}} header of the message replaces the {{application/json}}
that the producer sets before the copy. After an HTTP consumer or an earlier
HTTP call with another content type (for example {{text/plain}}), the GraphQL
request is sent with that content type, which a GraphQL server may reject (the
GraphQL over HTTP specification expects {{application/json}} for a POST
request).
Before CAMEL-22562, the producer skipped the {{queryHeader}} and
{{variablesHeader}} headers when it added the message headers to the request
(added by CAMEL-22561), and always sent the body as {{application/json}}.
CAMEL-22562 replaced that code with camel-http, which also dropped the skip.
*Fix*: after copying the headers, the producer removes the headers named by
{{queryHeader}} and {{variablesHeader}} from the internal request and sets
{{Content-Type: application/json}}, as before CAMEL-22562. The headers of the
original message are not changed.
*Tests*: new {{GraphqlProducerRequestHeadersTest}} (4 tests, JUnit assertions
as in the module) against a local httpcore5 server with an 8 KB header line
limit. All fail on main:
* {{queryHeaderIsNotSentAsHttpHeader}}: {{the query must only be sent in the
body ==> expected: <false> but was: <true>}};
* {{variablesHeaderIsNotSentAsHttpHeader}}: same for the variables;
* {{queryLongerThanTheServerHeaderLimitIsAnswered}}:
{{HttpOperationFailedException ... statusCode: 431}};
* {{bodyIsSentAsJsonWhenTheMessageHasAnotherContentType}}: {{expected:
<application/json> but was: <text/plain>}}.
camel-graphql unit tests with the fix: 32 run, 0 failures.
*How it was found*: regression mining, by looking for code that an earlier fix
added and a later change removed. CAMEL-22561 (4.16) added the skip of the
query and variables headers; CAMEL-22562 (4.19) moved the producer onto
camel-http, which does not have it.
*Affected*: main, camel-4.23.x and camel-4.22.x, and 4.19 to 4.21 (the producer
copies all headers to the camel-http request). camel-4.18.x and camel-4.14.x
still have the skip. Read, not run.
_Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
