oscerd opened a new pull request, #25378: URL: https://github.com/apache/camel/pull/25378
## What `CamelObjectInputStream` is the shared `ObjectInputStream` used by Camel's Java-object deserialization paths (e.g. the HTTP components), but it installed no `java.io.ObjectInputFilter`, so any code constructing it directly deserialized without a JEP-290 filter. This change makes `CamelObjectInputStream` resolve a filter via the existing `DeserializationFilterHelper` and install it with `setObjectInputFilter()`: - When no explicit pattern is supplied, the JVM-wide `jdk.serialFilter` is honoured if set, otherwise the default Camel allow-list (`DEFAULT_DESERIALIZATION_FILTER`) is applied — permits standard Java and Apache Camel types, denies `java.net.**`, and enforces JEP-290 graph-shape limits. - A new `CamelObjectInputStream(InputStream, CamelContext, String)` constructor accepts an explicit filter pattern. `HttpHelper` now passes its configured pattern through the new constructor instead of calling `setObjectInputFilter()` separately. The built-in HTTP path already applied the default filter (via `DeserializationFilterHelper`), so its runtime behaviour is unchanged — this closes the gap for any direct instantiation and centralizes the filter on the stream itself. ## Why Defense-in-depth against unsafe deserialization: the shared stream is now safe-by-default and configurable, consistent with the deserialization filtering already applied by `camel-jms`, `camel-mina`, `camel-netty` and `camel-netty-http`. ## Testing - New `CamelObjectInputStreamTest` (4 tests): the default filter allows standard types, rejects a class outside the allow-list, a blank pattern falls back to the default, and an explicit pattern can allow an otherwise-denied class. - Full-reactor `mvn clean install -DskipTests` passes. ## Docs - Upgrade-guide entry added to `camel-4x-upgrade-guide-4_22.adoc` (public `camel-support` class default change). _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
