[
https://issues.apache.org/jira/browse/CAMEL-26916?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26916 started by Claus Ibsen.
-------------------------------------------
> camel-yaml-dsl-validator - an insecure opt-in that can be set on the
> component keeps its default when reading the body
> ----------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26916
> URL: https://issues.apache.org/jira/browse/CAMEL-26916
> Project: Camel
> Issue Type: Improvement
> Components: camel-yaml-dsl, tooling
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Major
> Fix For: 4.24.0
>
>
> The YAML validator reads the body a step sends or receives from the body
> types in the catalog. When a body type depends on an option that the route
> does not set, but that can be set on the component, the body is not known and
> the validator says nothing.
> Since CAMEL-26012 the pulsar producer body depends on
> allowJavaSerializedObject, which is also a component option, so the validator
> no longer reports a route that sends parsed data (a Map) to pulsar. The same
> holds for transferExchange and objectMessageEnabled of jms, activemq,
> activemq6, amqp, sjms and sjms2, transferExchange and objectCodecPattern of
> mina, transferExchange of netty, and allowOperationHeader of keycloak and
> spiffe.
> These options are insecure opt-ins (security insecure:ssl,
> insecure:serialization or insecure:dev): off unless turned on, and one turned
> on for the whole component is reported by the security policy at startup. The
> validator should take their default when the route does not set them, so it
> reports the body again.
> Found while fixing TextBodyFlowTest on main (PR #29807).
> _Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
