oscerd opened a new issue, #732:
URL: https://github.com/apache/camel-karaf/issues/732
## Description
`components/camel-cxf/camel-cxf-all/src/main/java/org/apache/camel/component/cxf/transport/http/osgi/ServletExporter.java`
registers the CXF transport servlet with these init parameters:
```java
whiteboardProps.put("servlet.init.hide-service-list-page",
getProp(properties, CXF_SERVLET_PREFIX + "hide-service-list-page",
"false")); // :76-77
...
whiteboardProps.put("servlet.init.service-list-page-authenticate",
getProp(properties, CXF_SERVLET_PREFIX +
"service-list-page-authenticate", "false")); // :94-95
```
`HTTPTransportActivator` registers the `ManagedService`, so when no
`org.apache.cxf.osgi` configuration exists these defaults apply as-is --
including on the `properties == null` path (`:61-63`). The result is that
installing the feature publishes an enumerable, unauthenticated listing of
every CXF endpoint in the container at `/cxf`, with no configuration step
required to turn it on.
The `service-list-page-authenticate-realm` default is already `karaf`, so the
plumbing to authenticate the page is present; only the switch is off.
## Expected Behavior
The listing is opt-in. `hide-service-list-page` defaults to `"true"`, or the
page is authenticated against the karaf realm by default, and the PID is
documented in the camel-cxf feature docs so operators can turn it back on
deliberately.
## Actual Behavior
The page is served, unauthenticated, on a default install. The only opt-out
is a non-default system property or an explicit ConfigAdmin entry.
## Additional Context
- These values match historic upstream CXF defaults. CXF 4.x no longer ships
an OSGi transport module, so this glue is now maintained here and the
default is ours to choose.
- Each endpoint's `?wsdl` is reachable without authentication regardless, so
the listing is a discovery convenience rather than a new class of
disclosure -- which is why this is filed as a default-hardening change
rather than a defect.
- Changing the default is visible behaviour for anyone relying on the page;
it should be called out in the release notes.
---
_Claude Code on behalf of Andrea Cosentino_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
