davsclaus commented on code in PR #25361:
URL: https://github.com/apache/camel/pull/25361#discussion_r3721462415
##########
core/camel-core-model/src/main/java/org/apache/camel/model/RoutingSlipDefinition.java:
##########
@@ -54,6 +54,13 @@ public class RoutingSlipDefinition<Type extends
ProcessorDefinition<Type>> exten
description = "Configures the cache size for ProducerCache which
caches producers for reuse. The default cache size is 1000."
+ " Set to -1 to turn off caching.")
private String cacheSize;
+ @XmlAttribute
+ @Metadata(label = "advanced,security",
+ description = "Sets an optional comma-separated allow-list of
component schemes that the dynamic recipient"
+ + " may resolve to (e.g. http,https). When set, a
dynamic endpoint whose scheme is not in the"
+ + " list is rejected. This is a defence-in-depth
restriction, useful for low-code / Kamelet"
+ + " deployments; by default (unset) any scheme is
allowed.")
+ private String allowedSchemes;
Review Comment:
Same issue — the **copy constructor** (line ~73 in the new file) does not
copy this new `allowedSchemes` field.
`DynamicRouterDefinition` (which extends this class) shadows the field and
has its own copy constructor that IS updated, so `dynamicRouter` is fine. But
standalone `routingSlip` usage via route templating or advice would lose the
setting.
**Fix:** Add `this.allowedSchemes = source.allowedSchemes;` after the
`cacheSize` line in the copy constructor.
##########
core/camel-core-model/src/main/java/org/apache/camel/model/RecipientListDefinition.java:
##########
@@ -109,6 +109,13 @@ public class RecipientListDefinition<Type extends
ProcessorDefinition<Type>> ext
@Metadata(label = "advanced", javaType = "java.lang.Boolean",
description = "Shares the UnitOfWork with the parent and each of
the sub messages. Recipient List will by default not share unit of work between
the parent exchange and each recipient exchange. This means each sub exchange
has its own individual unit of work.")
private String shareUnitOfWork;
+ @XmlAttribute
+ @Metadata(label = "advanced,security",
+ description = "Sets an optional comma-separated allow-list of
component schemes that the dynamic recipient"
+ + " may resolve to (e.g. http,https). When set, a
dynamic endpoint whose scheme is not in the"
+ + " list is rejected. This is a defence-in-depth
restriction, useful for low-code / Kamelet"
+ + " deployments; by default (unset) any scheme is
allowed.")
+ private String allowedSchemes;
Review Comment:
The `allowedSchemes` field is added here, but the **copy constructor** (line
~123 in the new file) does not copy it. This means `copyDefinition()` — used by
route advice (`AdviceWith`), route template instantiation, etc. — will silently
lose the `allowedSchemes` setting.
All three other Definition classes with copy constructors
(`DynamicRouterDefinition`, `EnrichDefinition`, `PollEnrichDefinition`) are
correctly updated — this one is missed.
**Fix:** Add `this.allowedSchemes = source.allowedSchemes;` after the
`shareUnitOfWork` line in the copy constructor.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
