Claus Ibsen created CAMEL-26280:
-----------------------------------
Summary: camel-azure-functions - validate the function app and
name in invokeFunction
Key: CAMEL-26280
URL: https://issues.apache.org/jira/browse/CAMEL-26280
Project: Camel
Issue Type: Improvement
Components: camel-azure
Reporter: Claus Ibsen
Assignee: Claus Ibsen
Fix For: 4.24.0, 4.22.3
The invokeFunction operation of the azure-functions producer builds the invoke
URL as {{https://<functionApp>.azurewebsites.net/api/<functionName>}} with
{{String.format}} and then calls {{FunctionsInvocationClient.invoke}}. Both
values come from the endpoint configuration or from the
{{CamelAzureFunctionsFunctionApp}} / {{CamelAzureFunctionsFunctionName}}
headers, and neither is checked:
* An empty function app is not detected and turns into
{{https://null.azurewebsites.net/...}}, which only fails later with a confusing
connection error.
* A function app that is not a valid Azure app name (for example one containing
a dot, slash, colon or at sign) is copied into the URL as is, so the URL no
longer has the form the component documents.
* A function name containing a query string, a fragment or dot segments ({{.}}
/ {{..}}) is copied into the path as is.
h3. Change
* {{FunctionsProducer.invokeFunction}}:
** fail fast with an {{IllegalArgumentException}} when the function app is
missing;
** accept only a valid app name for the function app: letters, digits and
hyphens, not starting or ending with a hyphen, at most 60 characters;
** accept the function name as a relative path under {{/api/}}: one or more
segments separated by {{/}} (so HTTP triggers with a custom route such as
{{products/42}} keep working), rejecting {{?}}, {{#}}, {{\}}, {{%}}, empty
segments and {{.}} / {{..}} segments;
** build the URI with the multi-argument {{java.net.URI}} constructor instead
of {{String.format}}, and check that its host is
{{<functionApp>.azurewebsites.net}} before the invocation client is called.
* {{FunctionsEndpoint.getServiceUrl}}: apply the same function app validation.
* {{FunctionsInvocationClient}}: only add the function key header to https
requests on an {{azurewebsites.net}} host.
* Documentation: state the accepted forms of the function app and function name
in {{azure-functions-component.adoc}} (and the regenerated catalog copy), and
add a short note to the 4.24 upgrade guide: invokeFunction now rejects a
function app that is not a valid app name, and a function name containing a
query, a fragment or dot segments. Valid configurations are not affected.
h3. Tests
A new unit test class (no Azure access; a stubbed {{FunctionsInvocationClient}}
records the URL it is given):
* the URL is built on the app host for a plain app and function name;
* a function app given in the header is used when it is valid;
* a missing function app is rejected;
* a function app with a dot, slash, colon, at sign, question mark or hash is
rejected;
* a function name with a query or a fragment is rejected;
* a function name with dot segments is rejected;
* a multi-segment route path such as {{products/42}} is accepted.
The open CAMEL-26247 changes the same {{invokeFunction}} method; the two
changes should be coordinated so they do not conflict.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
