gnodet opened a new pull request, #25065: URL: https://github.com/apache/camel/pull/25065
## Summary _Claude Code on behalf of gnodet_ Fix 3 SonarCloud MAJOR vulnerabilities ([dashboard](https://sonarcloud.io/project/issues?id=apache_camel&types=VULNERABILITY&severities=MAJOR)): - **S6506** — `.github/workflows/camel-launcher-native-exe.yml:170` and `.github/actions/setup-llvm-mingw/install-llvm-mingw.sh:42`: Added `--proto '=https'` to `curl` commands to enforce HTTPS-only connections and prevent redirections to insecure websites. - **S5144** — `core/camel-support/AbstractExchange.java:211`: Suppressed with `@SuppressWarnings("java:S5144")` and documented justification. The flagged code is `ExchangeHelper.convertToType()` called from `evalPropertyValue()`, which performs type conversion on exchange properties. Per the [Camel security model](https://github.com/apache/camel/blob/main/docs/user-manual/modules/ROOT/pages/security-model.adoc), route authors are **fully trusted** — exchange properties are set by trusted route code, making this type conversion intentional framework behavior rather than a user-controlled URL construction vulnerability. ## Test plan - [x] `mvn formatter:format impsort:sort` — formatting passes - [x] `mvn -Psourcecheck validate` — style check passes - [x] `mvn test` on `core/camel-support` — all tests pass - [ ] CI pipeline (SonarCloud should clear the 3 MAJOR vulnerabilities after merge) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
