oscerd opened a new pull request, #25588: URL: https://github.com/apache/camel/pull/25588
Backport of #25587 to `camel-4.22.x`. ## Description `RedisConfiguration.createDefaultSerializer()` builds a bare `JdkSerializationRedisSerializer`, whose read path runs through Spring's `ConfigurableObjectInputStream` with no `ObjectInputFilter` installed. Every other component in the codebase that performs JDK deserialization resolves a filter first — `camel-spring-redis` was the one path left without one. Adds a `deserializationFilter` endpoint option (`advanced,security`). The default serializer now installs a filter resolved through `DeserializationFilterHelper`: the configured pattern when set, otherwise the JVM-wide `jdk.serialFilter`, otherwise the shared Camel allow-list. This covers the consumer, the producer read commands, and `SpringRedisIdempotentRepository`, which all share the default serializer. ## Differences from the main PR Only the upgrade-guide entry moved — it goes in `camel-4x-upgrade-guide-4_22.adoc` here rather than `4_23`. The code is identical: `DeserializationFilterHelper` exists on this branch with the same allow-list and JEP-290 graph-shape limits. ## Testing - `123/123` module tests pass, including the 5 new ones - Generated metadata verified in sync after a generation run --- **Do not merge before #25587.** --- _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
