oscerd opened a new pull request, #25310: URL: https://github.com/apache/camel/pull/25310
## What The ldif producer treated a message body that does not start with `version: 1` as a URL and dereferenced it (`URI.create(body).toURL().openStream()`). This content-sniffed mode switch was implicit. It is now gated by a new **`allowUrlBody`** option (default **`false`**, tagged `security="insecure:dev"`). ## Behaviour (breaking) With the default (`allowUrlBody=false`), a non-LDIF body is **rejected** with an `IllegalArgumentException` instead of being dereferenced as a URL — avoiding a content-sniffed URL fetch (SSRF) from untrusted body content. Routes that intentionally pass a URL as the body must now set `allowUrlBody=true` on the `ldif` endpoint. Documented in the upgrade guide. ## Tests - New `LdifAllowUrlBodyTest` asserts a non-LDIF body is rejected by default (no LDAP server needed — the rejection happens before the LDAP connection is used). - The existing `LdifRouteIT` (which feeds resource URLs as the body) now sets `allowUrlBody=true`. Full-reactor `mvn clean install -DskipTests` is green (catalog/docs/DSL + the `SecurityUtils` `insecure:dev` map entry regenerated). ## Backport **main only** — this changes a default to be more restrictive (breaking), so it is not backported to the maintenance branches. Closes CAMEL-24297. --- _Claude Code on behalf of Andrea Cosentino (@oscerd)_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
