oscerd opened a new pull request, #22815: URL: https://github.com/apache/camel/pull/22815
## Backport of #22801 Cherry-pick of #22801 onto `camel-4.14.x`, matching the original CAMEL-23297/19/21/22/24 hardening series backport pattern. **Original PR:** #22801 — CAMEL-23372: Tighten default ObjectInputFilter to deny java.net.** before java.** **Original author:** @oscerd **Target branch:** `camel-4.14.x` ### Conflict resolution - **Dropped the camel-netty (regular, not camel-netty-http) source change.** CAMEL-23297, which introduced the `DEFAULT_DESERIALIZATION_FILTER` constant in `NettyConverter.java` on `main`, was not backported to `camel-4.14.x`. Carrying my cherry-pick into 4.14.x would have introduced the constant unused. The remaining JMS / AMQP / sjms / mina / netty-http / vertx-http / infinispan / leveldb / cassandraql / consul / sql JDBC pieces are unchanged, since their respective parent backports (CAMEL-23319/21/22/24) ARE on 4.14.x. - Generated `*.json` catalog files (16 files) had non-trivial drift between `main` and `camel-4.14.x`. Resolved by taking the 4.14.x baseline, then regenerating via a full `mvn clean install -DskipTests`. - The upgrade-guide note that targeted `camel-4x-upgrade-guide-4_21.adoc` on `main` was removed; an equivalent note has been added to `camel-4x-upgrade-guide-4_14.adoc` instead (omitting `camel-netty` from the affected-component list there, consistent with the dropped piece). - A small unrelated catalog-version drift (`4.14.6-SNAPSHOT` → `4.14.8-SNAPSHOT`) is included for the 20 affected catalog/component json files since that is the deterministic regen output against the current `parent/pom.xml`. Other catalog files on this branch may still be at older versions — out of scope here. ### Original description (from #22801) Tightens the in-code default `ObjectInputFilter` introduced by CAMEL-23297 / CAMEL-23319 / CAMEL-23321 / CAMEL-23322 / CAMEL-23324 to explicitly deny classes under `java.net.**` before allowing the rest of `java.**`, `javax.**` and `org.apache.camel.**`. The recursive `java.**` allow in the previous default admitted classes whose `hashCode`/`equals`/`readObject` paths perform network I/O (notably `java.net.URL` and `java.net.InetAddress`, whose hash methods perform DNS resolution). The new default rejects classes under `java.net.*` while keeping `java.lang.*`, `java.util.*`, `java.sql.*`, `java.security.*`, etc. allowed. Per JEP 290, the filter is evaluated left-to-right. New default: ``` !java.net.**;java.**;javax.**;org.apache.camel.**;!* ``` (or `!java.net.**;java.**;org.apache.camel.**;!*` for the aggregation-repository components, which do not include `javax.**`.) ### Test plan - [x] `mvn clean install -DskipTests` from repo root: BUILD SUCCESS (4.14.x reactor) - [x] Tests carried over from #22801: `JmsBindingTest#testDefaultFilterRejectsJavaNetClass`, `JmsBindingDeserializationFilterTest#testDefaultFilterRejectsJavaNetClass`, `MinaConverterTest#testToObjectInputRejectsJavaNetClass`, `NettyHttpHelperDeserializationFilterTest#testDefaultFilterRejectsJavaNetClass`, `VertxHttpHelperDeserializationFilterTest#testDefaultFilterRejectsJavaNetClass`, `DefaultExchangeHolderUtilsTest#testDeserializeRejectsJavaNetClass`. (No `NettyConverterTest` change since the netty source piece was dropped.) ### Compatibility No public API changes. The endpoint option `deserializationFilter` and the JVM-wide `-Djdk.serialFilter` continue to override this default. --- _Filed by Claude Code on behalf of @oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
