oscerd commented on PR #25026: URL: https://github.com/apache/camel/pull/25026#issuecomment-5067338047
Thank you for the thorough review — all 4 blocking findings addressed: **High Severity (fixed):** 1. ✅ **RAW() false negative** — Removed `(?!RAW\\()` negative lookahead from `SECRET_IN_URI` regex. `password=RAW(secret)` is now correctly detected as a plain-text secret, consistent with `SecurityUtils.isPlainTextSecret` documentation. 2. ✅ **Empty insecureValue false positives** — Added early `continue` when `insecureValue` is null or empty. Options like `sslEndpointAlgorithm` with empty insecureValue no longer match any assignment. 3. ✅ **SQL composite scheme false positive** — `containsScheme()` now checks that the character before the scheme is not a letter, digit, or hyphen. `google-bigquery-sql:` no longer falsely matches as `sql:`. 4. ✅ **Route-level header filter check** — Replaced route-wide text search with per-consumer `hasHeaderFilterNearby()` that searches the next 20 lines after each consumer declaration (bounded by the next consumer occurrence). A `"camel*"` in a comment no longer suppresses all warnings. **Suggestion (acknowledged):** 5. Code duplication with `HardenTools` — Valid concern. The two tools serve different purposes (catalog-aware context vs line-level scanning) with different output formats. Extracting shared detection logic is a good follow-up but would need careful API design to serve both use cases. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
