[
https://issues.apache.org/jira/browse/CAMEL-25949?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18131706#comment-18131706
]
shashank commented on CAMEL-25949:
----------------------------------
Already fixed on main by CAMEL-25924 (apache/camel PR #28373, commit
27158e77a032): {{GraphqlProducer}} now removes the {{queryHeader}} and
{{variablesHeader}} headers from the HTTP request and sets {{Content-Type:
application/json}} after copying the message headers, with
{{GraphqlProducerHeadersTest}} covering both. Closing this one as a duplicate;
no separate PR.
_Claude Code on behalf of allthingssecurity_
> camel-graphql - the producer sends the queryHeader and variablesHeader
> headers as HTTP headers, and a Content-Type of the message replaces
> application/json
> -----------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-25949
> URL: https://issues.apache.org/jira/browse/CAMEL-25949
> Project: Camel
> Issue Type: Bug
> Components: camel-graphql
> Reporter: shashank
> Assignee: shashank
> Priority: Major
>
> {{GraphqlProducer}} sends its request through an internal camel-http endpoint
> since CAMEL-22562 (4.19). It copies all headers of the message to the
> internal exchange ({{MessageHelper.copyHeaders(exchange.getMessage(),
> httpExchange.getIn(), true)}}, main 9f839f4bcc9d), and camel-http sends every
> header that its {{HttpHeaderFilterStrategy}} lets through as an HTTP header.
> So:
> * the header named by {{queryHeader}} is sent as an HTTP header, with the
> whole query as its value, next to the same query in the JSON body. A query
> longer than the request header limit of the server fails (Jetty, Tomcat and
> Spring Boot accept 8 KB of request headers by default). A route with
> {{queryHeader=myQuery}} and a query of 10,000 characters gets
> {{HttpOperationFailedException ... statusCode: 431}} from a server with that
> limit;
> * the header named by {{variablesHeader}} (a {{JsonObject}}) is sent as an
> HTTP header as well, so the variables of every request (which can hold
> personal data or large values) also end up in a request header;
> * the {{Content-Type}} header of the message replaces the
> {{application/json}} that the producer sets before the copy. After an HTTP
> consumer or an earlier HTTP call with another content type (for example
> {{text/plain}}), the GraphQL request is sent with that content type, which a
> GraphQL server may reject (the GraphQL over HTTP specification expects
> {{application/json}} for a POST request).
> Before CAMEL-22562, the producer skipped the {{queryHeader}} and
> {{variablesHeader}} headers when it added the message headers to the request
> (added by CAMEL-22561), and always sent the body as {{application/json}}.
> CAMEL-22562 replaced that code with camel-http, which also dropped the skip.
> *Fix*: after copying the headers, the producer removes the headers named by
> {{queryHeader}} and {{variablesHeader}} from the internal request and sets
> {{Content-Type: application/json}}, as before CAMEL-22562. The headers of the
> original message are not changed.
> *Tests*: new {{GraphqlProducerRequestHeadersTest}} (4 tests, JUnit assertions
> as in the module) against a local httpcore5 server with an 8 KB header line
> limit. All fail on main:
> * {{queryHeaderIsNotSentAsHttpHeader}}: {{the query must only be sent in the
> body ==> expected: <false> but was: <true>}};
> * {{variablesHeaderIsNotSentAsHttpHeader}}: same for the variables;
> * {{queryLongerThanTheServerHeaderLimitIsAnswered}}:
> {{HttpOperationFailedException ... statusCode: 431}};
> * {{bodyIsSentAsJsonWhenTheMessageHasAnotherContentType}}: {{expected:
> <application/json> but was: <text/plain>}}.
> camel-graphql unit tests with the fix: 32 run, 0 failures.
> *How it was found*: regression mining, by looking for code that an earlier
> fix added and a later change removed. CAMEL-22561 (4.16) added the skip of
> the query and variables headers; CAMEL-22562 (4.19) moved the producer onto
> camel-http, which does not have it.
> *Affected*: main, camel-4.23.x and camel-4.22.x, and 4.19 to 4.21 (the
> producer copies all headers to the camel-http request). camel-4.18.x and
> camel-4.14.x still have the skip. Read, not run.
> _Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
