Claus Ibsen created CAMEL-26916:
-----------------------------------
Summary: camel-yaml-dsl-validator - an insecure opt-in that can be
set on the component keeps its default when reading the body
Key: CAMEL-26916
URL: https://issues.apache.org/jira/browse/CAMEL-26916
Project: Camel
Issue Type: Improvement
Components: camel-yaml-dsl, tooling
Reporter: Claus Ibsen
Assignee: Claus Ibsen
Fix For: 4.24.0
The YAML validator reads the body a step sends or receives from the body types
in the catalog. When a body type depends on an option that the route does not
set, but that can be set on the component, the body is not known and the
validator says nothing.
Since CAMEL-26012 the pulsar producer body depends on
allowJavaSerializedObject, which is also a component option, so the validator
no longer reports a route that sends parsed data (a Map) to pulsar. The same
holds for transferExchange and objectMessageEnabled of jms, activemq,
activemq6, amqp, sjms and sjms2, transferExchange and objectCodecPattern of
mina, transferExchange of netty, and allowOperationHeader of keycloak and
spiffe.
These options are insecure opt-ins (security insecure:ssl,
insecure:serialization or insecure:dev): off unless turned on, and one turned
on for the whole component is reported by the security policy at startup. The
validator should take their default when the route does not set them, so it
reports the body again.
Found while fixing TextBodyFlowTest on main (PR #29807).
_Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
