This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 27a26cdb730c (chores): fix SonarCloud MAJOR vulnerabilities (S6506,
S5144)
27a26cdb730c is described below
commit 27a26cdb730c515827089de70b48add9ee4957f6
Author: Guillaume Nodet <[email protected]>
AuthorDate: Sat Jul 25 11:40:18 2026 +0200
(chores): fix SonarCloud MAJOR vulnerabilities (S6506, S5144)
Enforce HTTPS-only downloads with --proto '=https' in curl commands
to prevent HTTP redirect attacks (S6506). Suppress S5144 in
AbstractExchange.evalPropertyValue() — exchange properties are set
by trusted route authors per the Camel security model; type conversion
of exchange-internal values is intentional framework behavior, not
user-controlled URL construction.
Closes #25065
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---
.github/actions/setup-llvm-mingw/install-llvm-mingw.sh | 2 +-
.github/workflows/camel-launcher-native-exe.yml | 2 +-
.../src/main/java/org/apache/camel/support/AbstractExchange.java | 5 ++++-
3 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/.github/actions/setup-llvm-mingw/install-llvm-mingw.sh
b/.github/actions/setup-llvm-mingw/install-llvm-mingw.sh
index 8b0c8c465338..d9abdbf2ec7c 100755
--- a/.github/actions/setup-llvm-mingw/install-llvm-mingw.sh
+++ b/.github/actions/setup-llvm-mingw/install-llvm-mingw.sh
@@ -39,7 +39,7 @@
DEST="${INSTALL_DIR}/llvm-mingw-${VERSION}-ucrt-ubuntu-22.04-x86_64"
if [ ! -x "${DEST}/bin/x86_64-w64-mingw32-clang" ]; then
mkdir -p "$INSTALL_DIR"
- curl -fsSL -o "${INSTALL_DIR}/${TARBALL}" \
+ curl -fsSL --proto '=https' -o "${INSTALL_DIR}/${TARBALL}" \
"https://github.com/mstorsjo/llvm-mingw/releases/download/${VERSION}/${TARBALL}";
echo "${SHA256} ${INSTALL_DIR}/${TARBALL}" | sha256sum -c -
tar -xf "${INSTALL_DIR}/${TARBALL}" -C "$INSTALL_DIR"
diff --git a/.github/workflows/camel-launcher-native-exe.yml
b/.github/workflows/camel-launcher-native-exe.yml
index 0bdc5aa45884..2386033a13b0 100644
--- a/.github/workflows/camel-launcher-native-exe.yml
+++ b/.github/workflows/camel-launcher-native-exe.yml
@@ -179,7 +179,7 @@ jobs:
VERSION=$(mvn help:evaluate -Dexpression=project.version -q
-DforceStdout -N)
META="https://repository.apache.org/snapshots/org/apache/camel/camel-launcher/${VERSION}/maven-metadata.xml";
echo "Checking ${META}"
- if ! curl -fsSL -o /dev/null "${META}"; then
+ if ! curl -fsSL --proto '=https' -o /dev/null "${META}"; then
echo "ERROR: camel-launcher ${VERSION} is not on the Apache
snapshot repository."
echo "This job resolves the launcher's upstream modules from there
(no -am build)."
echo "Wait for a main-branch snapshot deploy of ${VERSION}, or
rebuild with -am."
diff --git
a/core/camel-support/src/main/java/org/apache/camel/support/AbstractExchange.java
b/core/camel-support/src/main/java/org/apache/camel/support/AbstractExchange.java
index e14b699d37cb..10cc6ee63742 100644
---
a/core/camel-support/src/main/java/org/apache/camel/support/AbstractExchange.java
+++
b/core/camel-support/src/main/java/org/apache/camel/support/AbstractExchange.java
@@ -192,7 +192,10 @@ abstract class AbstractExchange implements Exchange,
ExchangeExtension {
return evalPropertyValue(type, value);
}
- @SuppressWarnings("unchecked")
+ // Suppressed S5144: exchange properties are set by trusted route authors
— type conversion of
+ // exchange-internal values is intentional framework behavior, not
user-controlled URL construction.
+ // See the Camel security model
(docs/user-manual/modules/ROOT/pages/security-model.adoc).
+ @SuppressWarnings({ "unchecked", "java:S5144" })
private <T> T evalPropertyValue(final Class<T> type, final Object value) {
if (value == null) {
// let's avoid NullPointerException when converting to boolean for
null values
