[
https://issues.apache.org/jira/browse/CAMEL-26012?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen reassigned CAMEL-26012:
-----------------------------------
Assignee: Claus Ibsen
> camel-pulsar - turn off the Java serialization of bodies that do not convert
> to bytes, and deprecate it
> -------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26012
> URL: https://issues.apache.org/jira/browse/CAMEL-26012
> Project: Camel
> Issue Type: Improvement
> Components: camel-pulsar
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Major
> Fix For: 4.24.0
>
>
> The pulsar producer sends the body as bytes: it converts the body to a byte
> array, and when that fails it falls back to Java serialization
> ({{PulsarProducer}}, main 56aa5f4970a6, lines 114-121;
> {{PulsarMessageUtils.serialize}}, lines 77-82). So a Map, a List, a number, a
> Serializable POJO and no body at all are sent as Java-serialized bytes, which
> only a Java client that deserializes them can read, and a POJO that is not
> Serializable fails with a NotSerializableException. The docs and the options
> do not say so.
> Checked on 4.24.0-SNAPSHOT with {{camel run}} against {{camel infra run
> pulsar}}, with a pulsar consumer that gives the payload as a byte array:
> * text, bytes, a stream and a file arrive as their bytes;
> * a LinkedHashMap, an ArrayList, the Integer 42 and a Serializable POJO
> arrive as Java-serialized bytes ({{AC ED 00 05}} ...);
> * no body arrives as the five bytes of a serialized null;
> * a POJO that is not Serializable fails with
> {{java.io.NotSerializableException}}.
> *Proposed change*: turn the fallback off, so a body that does not convert to
> a byte array fails with an error that says to marshal it first. Keep the old
> behaviour behind an option that is deprecated from the start (for example
> {{allowJavaSerializedObject}}, with {{security = "insecure:serialization"}}),
> to be removed later. The new default needs an entry in the upgrade guide. The
> google-pubsub producer has a similar fallback (CAMEL-25956).
> _Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
