Claus Ibsen created CAMEL-26094:
-----------------------------------
Summary: camel-aws-security-hub - a Filters header as JSON text is
dropped, and the next token of getFindings is sent by the next operation
Key: CAMEL-26094
URL: https://issues.apache.org/jira/browse/CAMEL-26094
Project: Camel
Issue Type: Bug
Components: camel-aws2
Affects Versions: 4.18.0, 4.22.0, 4.23.0
Reporter: Claus Ibsen
Fix For: 4.24.0
Found while adding the catalog body types of aws-security-hub (CAMEL-24961).
h4. 1. A Filters header as JSON text is dropped, so getFindings returns every
finding
getFindings reads {{CamelAwsSecurityHubFilters}} with {{getHeader(name,
AwsSecurityFindingFilters.class)}} ({{SecurityHubProducer}}, main ed3d719b379c,
line 168), which gives null for JSON text, as there is no type converter. The
request then has no filter and returns every finding, with no error. Checked on
4.24.0-SNAPSHOT with {{camel run}} against a fake of the AWS API that logs the
requests it gets: the header {{\{"SeverityLabel": [\{"Value": "HIGH"\}]\}}}
gives the request {{\{\}}}. The same holds for the Note, Severity and Workflow
updates of batchUpdateFindings (lines 204-217, read in the code).
h4. 2. The next token of getFindings is sent by the next operation
{{CamelAwsSecurityHubNextToken}} is an input and an output of getFindings,
getFindingHistory and listEnabledProductsForImport (lines 172, 184, 282, 296,
343 and 357). Checked on 4.24.0-SNAPSHOT with {{camel run}} against a fake of
the AWS API that logs the requests it gets: after getFindings set it to
"tok-1", a listEnabledProductsForImport in the same route sent {{GET
/productSubscriptions?NextToken=tok-1}}.
h4. 3. The findings in the body must be a java.util.List
batchImportFindings takes the findings from the {{CamelAwsSecurityHubFindings}}
header, converted to a List, or else from the body, which must be a
{{java.util.List}} or one AwsSecurityFinding (lines 137-148). Checked on
4.24.0-SNAPSHOT with {{camel run}} against a fake of the AWS API that logs the
requests it gets: an array or a Set of findings in the body fails with "At
least one finding must be specified", while the header takes them, and a List
of anything else fails in the AWS SDK with a ClassCastException.
h4. Also read in the code, not run
* The page lists six operations and misses getFindingAggregator (CAMEL-24203).
* A finding that Security Hub does not import does not fail the exchange: it is
only in the FailedCount header and the response.
_Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
