oscerd opened a new pull request, #25026:
URL: https://github.com/apache/camel/pull/25026
## Summary
Adds a new MCP tool `camel_security_scan` that performs static analysis of
Camel route definitions to detect security anti-patterns. Distinct from
`camel_route_harden_context` (which provides general security context and CVE
advisories), this tool performs **line-by-line analysis** and returns
actionable findings with severity, line numbers, and remediation guidance.
### Detection Categories
| Category | Severity | What it detects |
|----------|----------|----------------|
| `insecure:serialization` | Critical | `allowJavaSerializedObject=true`,
`transferException=true`, `transferExchange=true`, etc. |
| `insecure:ssl` | High | `trustAllCertificates=true`, `skipTlsVerify=true`,
`hostnameVerification=false`, etc. |
| `insecure:dev` | Medium | `devConsoleEnabled=true`,
`downloadEnabled=true`, etc. |
| `secret` | Critical | Plain-text passwords/tokens/API keys in URIs,
connection strings with embedded credentials |
| `header-injection` | High | HTTP consumers without
`removeHeaders("Camel*")` or `HeaderFilterStrategy` (CVE-2025-27636 family) |
| `command-injection` | Critical | `exec:` component usage |
| `sql-injection` | High | SQL queries without parameterized parameters |
| `path-traversal` | Medium | File paths with dynamic expressions |
Uses `SecurityUtils.getSecurityOptions()` from `camel-util` for the
comprehensive list of 24 insecure configuration options, ensuring consistency
with Camel's built-in security policy framework.
### Output Format
Returns structured `SecurityScanResult` with:
- `findings[]`: each finding has `severity`, `category`, `issue`, `line`
(1-based), `remediation`
- `totalFindings`: count
- `severityCounts`: breakdown by severity level
- Findings sorted by severity (critical first)
## Test plan
- [x] 24 test cases covering all detection categories
- [x] False positive tests (placeholder passwords, HTTPS, SFTP not flagged)
- [x] Line number accuracy verification
- [x] Severity sorting verification
- [x] Severity count accuracy
- [x] All 324 existing tests pass (no regressions)
_Claude Code on behalf of oscerd_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
