Claus Ibsen created CAMEL-26012:
-----------------------------------
Summary: camel-pulsar - turn off the Java serialization of bodies
that do not convert to bytes, and deprecate it
Key: CAMEL-26012
URL: https://issues.apache.org/jira/browse/CAMEL-26012
Project: Camel
Issue Type: Improvement
Components: camel-pulsar
Reporter: Claus Ibsen
Fix For: 4.24.0
The pulsar producer sends the body as bytes: it converts the body to a byte
array, and when that fails it falls back to Java serialization
({{PulsarProducer}}, main 56aa5f4970a6, lines 114-121;
{{PulsarMessageUtils.serialize}}, lines 77-82). So a Map, a List, a number, a
Serializable POJO and no body at all are sent as Java-serialized bytes, which
only a Java client that deserializes them can read, and a POJO that is not
Serializable fails with a NotSerializableException. The docs and the options do
not say so.
Checked on 4.24.0-SNAPSHOT with {{camel run}} against {{camel infra run
pulsar}}, with a pulsar consumer that gives the payload as a byte array:
* text, bytes, a stream and a file arrive as their bytes;
* a LinkedHashMap, an ArrayList, the Integer 42 and a Serializable POJO arrive
as Java-serialized bytes ({{AC ED 00 05}} ...);
* no body arrives as the five bytes of a serialized null;
* a POJO that is not Serializable fails with
{{java.io.NotSerializableException}}.
*Proposed change*: turn the fallback off, so a body that does not convert to a
byte array fails with an error that says to marshal it first. Keep the old
behaviour behind an option that is deprecated from the start (for example
{{allowJavaSerializedObject}}, with {{security = "insecure:serialization"}}),
to be removed later. The new default needs an entry in the upgrade guide. The
google-pubsub producer has a similar fallback (CAMEL-25956).
_Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
