This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 9c30b32b69dc CAMEL-24509: camel-mina - gate the exchange-holder
unmarshal on transferExchange and mark objectCodecPattern (#25788)
9c30b32b69dc is described below
commit 9c30b32b69dc7f2aa8f35f202e750ba17976c9e0
Author: Andrea Cosentino <[email protected]>
AuthorDate: Thu Aug 27 11:19:42 2026 +0200
CAMEL-24509: camel-mina - gate the exchange-holder unmarshal on
transferExchange and mark objectCodecPattern (#25788)
MinaPayloadHelper.setIn/setOut unmarshalled an inbound DefaultExchangeHolder
whenever the decoded object happened to be one, with no check that the
endpoint
had enabled transferExchange. DefaultExchangeHolder.unmarshal rebuilds the
whole
Exchange from the payload - id, body, headers via a wholesale setHeaders,
out
message and every property. camel-jms gates the same call behind
isObjectMessageEnabled() and checkDeserializedClass(); camel-mina had
neither.
This is defence in depth rather than a reachable hole: the object codec's
accept-list refuses an arbitrary class when objectCodecPattern is unset,
which
is the default, so a holder only reaches the helper once an operator has
widened
that pattern.
objectCodecPattern is therefore also marked security =
"insecure:serialization",
matching transferExchange on the same configuration class, and its
description
now warns that "*" accepts every loadable class from an untrusted peer.
setIn/setOut gain endpoint-taking overloads; the previous two-argument ones
are
deprecated and no longer unmarshal.
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
.../org/apache/camel/catalog/components/mina.json | 4 +-
components/camel-mina/pom.xml | 5 ++
.../org/apache/camel/component/mina/mina.json | 4 +-
.../camel/component/mina/MinaConfiguration.java | 7 +-
.../apache/camel/component/mina/MinaConsumer.java | 2 +-
.../camel/component/mina/MinaPayloadHelper.java | 43 +++++++++-
.../apache/camel/component/mina/MinaProducer.java | 4 +-
.../component/mina/MinaExchangeHolderGateTest.java | 99 ++++++++++++++++++++++
.../java/org/apache/camel/util/SecurityUtils.java | 1 +
.../component/dsl/MinaComponentBuilderFactory.java | 7 +-
.../endpoint/dsl/MinaEndpointBuilderFactory.java | 21 ++++-
11 files changed, 181 insertions(+), 16 deletions(-)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/mina.json
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/mina.json
index 48dbdeb45d9d..23053a0d6af3 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/mina.json
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/mina.json
@@ -47,7 +47,7 @@
"encoderMaxLineLength": { "index": 20, "kind": "property", "displayName":
"Encoder Max Line Length", "group": "codec", "label": "codec", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": -1, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "To set the textline protocol encoder max line
length. By default the default value of [...]
"encoding": { "index": 21, "kind": "property", "displayName": "Encoding",
"group": "codec", "label": "codec", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "You can configure the encoding (a charset
name) to use for the TCP textline codec and the UDP protocol. If not provided,
[...]
"filters": { "index": 22, "kind": "property", "displayName": "Filters",
"group": "codec", "label": "codec", "required": false, "type": "array",
"javaType": "java.util.List<org.apache.mina.core.filterchain.IoFilter>",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "You can set a list of Mina IoFilters to use."
},
- "objectCodecPattern": { "index": 23, "kind": "property", "displayName":
"Object Codec Pattern", "group": "codec", "label": "codec", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "Accept the wildcard specified classes for
Object deserialization, unless they are otherwise rejecte [...]
+ "objectCodecPattern": { "index": 23, "kind": "property", "displayName":
"Object Codec Pattern", "group": "codec", "label": "codec", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "security": "insecure:serialization",
"configurationClass": "org.apache.camel.component.mina.MinaConfiguration",
"configurationField": "configuration", "description": "Accept the wildcard
specified classes for Object deserializat [...]
"textline": { "index": 24, "kind": "property", "displayName": "Textline",
"group": "codec", "label": "codec", "required": false, "type": "boolean",
"javaType": "boolean", "deprecated": false, "autowired": false, "secret":
false, "defaultValue": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "Only used for TCP. If no codec is specified,
you can use this flag to indicate a text line based codec; if [...]
"textlineDelimiter": { "index": 25, "kind": "property", "displayName":
"Textline Delimiter", "group": "codec", "label": "codec", "required": false,
"type": "enum", "javaType":
"org.apache.camel.component.mina.MinaTextLineDelimiter", "enum": [ "DEFAULT",
"AUTO", "UNIX", "WINDOWS", "MAC" ], "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "Only used [...]
"sslContextParameters": { "index": 26, "kind": "property", "displayName":
"Ssl Context Parameters", "group": "security", "label": "security", "required":
false, "type": "object", "javaType":
"org.apache.camel.support.jsse.SSLContextParameters", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "To configure SSL security." },
@@ -86,7 +86,7 @@
"encoderMaxLineLength": { "index": 23, "kind": "parameter", "displayName":
"Encoder Max Line Length", "group": "codec", "label": "codec", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": -1, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "To set the textline protocol encoder max line
length. By default the default value of [...]
"encoding": { "index": 24, "kind": "parameter", "displayName": "Encoding",
"group": "codec", "label": "codec", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "You can configure the encoding (a charset
name) to use for the TCP textline codec and the UDP protocol. If not provided,
[...]
"filters": { "index": 25, "kind": "parameter", "displayName": "Filters",
"group": "codec", "label": "codec", "required": false, "type": "array",
"javaType": "java.util.List<org.apache.mina.core.filterchain.IoFilter>",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "You can set a list of Mina IoFilters to use."
},
- "objectCodecPattern": { "index": 26, "kind": "parameter", "displayName":
"Object Codec Pattern", "group": "codec", "label": "codec", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "Accept the wildcard specified classes for
Object deserialization, unless they are otherwise reject [...]
+ "objectCodecPattern": { "index": 26, "kind": "parameter", "displayName":
"Object Codec Pattern", "group": "codec", "label": "codec", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "security": "insecure:serialization",
"configurationClass": "org.apache.camel.component.mina.MinaConfiguration",
"configurationField": "configuration", "description": "Accept the wildcard
specified classes for Object deserializa [...]
"textline": { "index": 27, "kind": "parameter", "displayName": "Textline",
"group": "codec", "label": "codec", "required": false, "type": "boolean",
"javaType": "boolean", "deprecated": false, "autowired": false, "secret":
false, "defaultValue": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "Only used for TCP. If no codec is specified,
you can use this flag to indicate a text line based codec; i [...]
"textlineDelimiter": { "index": 28, "kind": "parameter", "displayName":
"Textline Delimiter", "group": "codec", "label": "codec", "required": false,
"type": "enum", "javaType":
"org.apache.camel.component.mina.MinaTextLineDelimiter", "enum": [ "DEFAULT",
"AUTO", "UNIX", "WINDOWS", "MAC" ], "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "Only used [...]
"sslContextParameters": { "index": 29, "kind": "parameter", "displayName":
"Ssl Context Parameters", "group": "security", "label": "security", "required":
false, "type": "object", "javaType":
"org.apache.camel.support.jsse.SSLContextParameters", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "To configure SSL security." }
diff --git a/components/camel-mina/pom.xml b/components/camel-mina/pom.xml
index d6bcaa1cfcd4..65d99801f280 100644
--- a/components/camel-mina/pom.xml
+++ b/components/camel-mina/pom.xml
@@ -75,6 +75,11 @@
<version>${mockito-version}</version>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>org.assertj</groupId>
+ <artifactId>assertj-core</artifactId>
+ <scope>test</scope>
+ </dependency>
</dependencies>
</project>
diff --git
a/components/camel-mina/src/generated/resources/META-INF/org/apache/camel/component/mina/mina.json
b/components/camel-mina/src/generated/resources/META-INF/org/apache/camel/component/mina/mina.json
index 48dbdeb45d9d..23053a0d6af3 100644
---
a/components/camel-mina/src/generated/resources/META-INF/org/apache/camel/component/mina/mina.json
+++
b/components/camel-mina/src/generated/resources/META-INF/org/apache/camel/component/mina/mina.json
@@ -47,7 +47,7 @@
"encoderMaxLineLength": { "index": 20, "kind": "property", "displayName":
"Encoder Max Line Length", "group": "codec", "label": "codec", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": -1, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "To set the textline protocol encoder max line
length. By default the default value of [...]
"encoding": { "index": 21, "kind": "property", "displayName": "Encoding",
"group": "codec", "label": "codec", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "You can configure the encoding (a charset
name) to use for the TCP textline codec and the UDP protocol. If not provided,
[...]
"filters": { "index": 22, "kind": "property", "displayName": "Filters",
"group": "codec", "label": "codec", "required": false, "type": "array",
"javaType": "java.util.List<org.apache.mina.core.filterchain.IoFilter>",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "You can set a list of Mina IoFilters to use."
},
- "objectCodecPattern": { "index": 23, "kind": "property", "displayName":
"Object Codec Pattern", "group": "codec", "label": "codec", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "Accept the wildcard specified classes for
Object deserialization, unless they are otherwise rejecte [...]
+ "objectCodecPattern": { "index": 23, "kind": "property", "displayName":
"Object Codec Pattern", "group": "codec", "label": "codec", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "security": "insecure:serialization",
"configurationClass": "org.apache.camel.component.mina.MinaConfiguration",
"configurationField": "configuration", "description": "Accept the wildcard
specified classes for Object deserializat [...]
"textline": { "index": 24, "kind": "property", "displayName": "Textline",
"group": "codec", "label": "codec", "required": false, "type": "boolean",
"javaType": "boolean", "deprecated": false, "autowired": false, "secret":
false, "defaultValue": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "Only used for TCP. If no codec is specified,
you can use this flag to indicate a text line based codec; if [...]
"textlineDelimiter": { "index": 25, "kind": "property", "displayName":
"Textline Delimiter", "group": "codec", "label": "codec", "required": false,
"type": "enum", "javaType":
"org.apache.camel.component.mina.MinaTextLineDelimiter", "enum": [ "DEFAULT",
"AUTO", "UNIX", "WINDOWS", "MAC" ], "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "Only used [...]
"sslContextParameters": { "index": 26, "kind": "property", "displayName":
"Ssl Context Parameters", "group": "security", "label": "security", "required":
false, "type": "object", "javaType":
"org.apache.camel.support.jsse.SSLContextParameters", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "To configure SSL security." },
@@ -86,7 +86,7 @@
"encoderMaxLineLength": { "index": 23, "kind": "parameter", "displayName":
"Encoder Max Line Length", "group": "codec", "label": "codec", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": -1, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "To set the textline protocol encoder max line
length. By default the default value of [...]
"encoding": { "index": 24, "kind": "parameter", "displayName": "Encoding",
"group": "codec", "label": "codec", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "You can configure the encoding (a charset
name) to use for the TCP textline codec and the UDP protocol. If not provided,
[...]
"filters": { "index": 25, "kind": "parameter", "displayName": "Filters",
"group": "codec", "label": "codec", "required": false, "type": "array",
"javaType": "java.util.List<org.apache.mina.core.filterchain.IoFilter>",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "You can set a list of Mina IoFilters to use."
},
- "objectCodecPattern": { "index": 26, "kind": "parameter", "displayName":
"Object Codec Pattern", "group": "codec", "label": "codec", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "Accept the wildcard specified classes for
Object deserialization, unless they are otherwise reject [...]
+ "objectCodecPattern": { "index": 26, "kind": "parameter", "displayName":
"Object Codec Pattern", "group": "codec", "label": "codec", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "security": "insecure:serialization",
"configurationClass": "org.apache.camel.component.mina.MinaConfiguration",
"configurationField": "configuration", "description": "Accept the wildcard
specified classes for Object deserializa [...]
"textline": { "index": 27, "kind": "parameter", "displayName": "Textline",
"group": "codec", "label": "codec", "required": false, "type": "boolean",
"javaType": "boolean", "deprecated": false, "autowired": false, "secret":
false, "defaultValue": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "Only used for TCP. If no codec is specified,
you can use this flag to indicate a text line based codec; i [...]
"textlineDelimiter": { "index": 28, "kind": "parameter", "displayName":
"Textline Delimiter", "group": "codec", "label": "codec", "required": false,
"type": "enum", "javaType":
"org.apache.camel.component.mina.MinaTextLineDelimiter", "enum": [ "DEFAULT",
"AUTO", "UNIX", "WINDOWS", "MAC" ], "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "Only used [...]
"sslContextParameters": { "index": 29, "kind": "parameter", "displayName":
"Ssl Context Parameters", "group": "security", "label": "security", "required":
false, "type": "object", "javaType":
"org.apache.camel.support.jsse.SSLContextParameters", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.mina.MinaConfiguration", "configurationField":
"configuration", "description": "To configure SSL security." }
diff --git
a/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaConfiguration.java
b/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaConfiguration.java
index 4be77e317f08..4a840a5f5d70 100644
---
a/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaConfiguration.java
+++
b/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaConfiguration.java
@@ -73,7 +73,7 @@ public class MinaConfiguration implements Cloneable {
private List<IoFilter> filters;
@UriParam(label = "codec", defaultValue = "true")
private boolean allowDefaultCodec = true;
- @UriParam(label = "codec")
+ @UriParam(label = "codec", security = "insecure:serialization")
private String objectCodecPattern;
@UriParam
private boolean disconnect;
@@ -328,6 +328,11 @@ public class MinaConfiguration implements Cloneable {
/**
* Accept the wildcard specified classes for Object deserialization,
unless they are otherwise rejected. Multiple
* patterns can be separated by comma.
+ * <p>
+ * This widens the codec's deserialization allow-list, so keep it as
narrow as the route actually needs. Avoid
+ * <tt>*</tt>: it accepts every class the classpath can load from an
untrusted peer, including Camel's own
+ * <tt>org.apache.camel</tt> types. Leaving the option unset is the safest
choice - the codec then accepts only the
+ * small built-in set and refuses anything else.
*/
public void setObjectCodecPattern(String pattern) {
this.objectCodecPattern = pattern;
diff --git
a/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaConsumer.java
b/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaConsumer.java
index cd019ec8977d..72877ace2a67 100644
---
a/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaConsumer.java
+++
b/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaConsumer.java
@@ -385,7 +385,7 @@ public class MinaConsumer extends DefaultConsumer {
exchange.getIn().setHeader(MinaConstants.MINA_IOSESSION, session);
exchange.getIn().setHeader(MinaConstants.MINA_LOCAL_ADDRESS,
session.getLocalAddress());
exchange.getIn().setHeader(MinaConstants.MINA_REMOTE_ADDRESS,
session.getRemoteAddress());
- MinaPayloadHelper.setIn(exchange, payload);
+ MinaPayloadHelper.setIn(getEndpoint(), exchange, payload);
return exchange;
}
diff --git
a/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaPayloadHelper.java
b/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaPayloadHelper.java
index b786ca9f45fb..2bcc6523049e 100644
---
a/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaPayloadHelper.java
+++
b/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaPayloadHelper.java
@@ -52,8 +52,8 @@ public final class MinaPayloadHelper {
}
}
- public static void setIn(Exchange exchange, Object payload) {
- if (payload instanceof DefaultExchangeHolder) {
+ public static void setIn(MinaEndpoint endpoint, Exchange exchange, Object
payload) {
+ if (isExchangeTransfer(endpoint, payload)) {
DefaultExchangeHolder.unmarshal(exchange, (DefaultExchangeHolder)
payload);
} else {
// normal transfer using the body only
@@ -61,8 +61,8 @@ public final class MinaPayloadHelper {
}
}
- public static void setOut(Exchange exchange, Object payload) {
- if (payload instanceof DefaultExchangeHolder) {
+ public static void setOut(MinaEndpoint endpoint, Exchange exchange, Object
payload) {
+ if (isExchangeTransfer(endpoint, payload)) {
DefaultExchangeHolder.unmarshal(exchange, (DefaultExchangeHolder)
payload);
} else {
// normal transfer using the body only and preserve the headers
@@ -70,4 +70,39 @@ public final class MinaPayloadHelper {
exchange.getOut().setBody(payload);
}
}
+
+ /**
+ * A decoded {@link DefaultExchangeHolder} rebuilds the entire Exchange -
id, body, headers, out message and every
+ * property - so it is only honoured when the endpoint asked for exchange
transfer in the first place. Without that
+ * check any peer able to reach an endpoint using the object codec, which
is the default when {@code textline} is
+ * not set, could hand the route a whole Exchange of its choosing; the
holder lives in the allow-listed
+ * {@code org.apache.camel} namespace, so {@code objectCodecPattern} does
not constrain it. This mirrors
+ * {@code JmsBinding}, which likewise unmarshals a holder only on the
opted-in path.
+ */
+ private static boolean isExchangeTransfer(MinaEndpoint endpoint, Object
payload) {
+ return payload instanceof DefaultExchangeHolder
+ && endpoint != null &&
endpoint.getConfiguration().isTransferExchange();
+ }
+
+ /**
+ * @deprecated use {@link #setIn(MinaEndpoint, Exchange,
Object)}. This overload has no endpoint and so
+ * cannot check {@code transferExchange} before
unmarshalling a {@link DefaultExchangeHolder}.
+ * @param exchange the exchange
+ * @param payload the decoded payload
+ */
+ @Deprecated
+ public static void setIn(Exchange exchange, Object payload) {
+ setIn(null, exchange, payload);
+ }
+
+ /**
+ * @deprecated use {@link #setOut(MinaEndpoint, Exchange,
Object)}. This overload has no endpoint and so
+ * cannot check {@code transferExchange} before
unmarshalling a {@link DefaultExchangeHolder}.
+ * @param exchange the exchange
+ * @param payload the decoded payload
+ */
+ @Deprecated
+ public static void setOut(Exchange exchange, Object payload) {
+ setOut(null, exchange, payload);
+ }
}
diff --git
a/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaProducer.java
b/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaProducer.java
index ddb26027906d..8b560615eba7 100644
---
a/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaProducer.java
+++
b/components/camel-mina/src/main/java/org/apache/camel/component/mina/MinaProducer.java
@@ -186,9 +186,9 @@ public class MinaProducer extends DefaultProducer {
} else {
// set the result on either IN or OUT on the original exchange
depending on its pattern
if (ExchangeHelper.isOutCapable(exchange)) {
- MinaPayloadHelper.setOut(exchange, handler.getMessage());
+ MinaPayloadHelper.setOut(getEndpoint(), exchange,
handler.getMessage());
} else {
- MinaPayloadHelper.setIn(exchange, handler.getMessage());
+ MinaPayloadHelper.setIn(getEndpoint(), exchange,
handler.getMessage());
}
}
}
diff --git
a/components/camel-mina/src/test/java/org/apache/camel/component/mina/MinaExchangeHolderGateTest.java
b/components/camel-mina/src/test/java/org/apache/camel/component/mina/MinaExchangeHolderGateTest.java
new file mode 100644
index 000000000000..99a0fa330ab4
--- /dev/null
+++
b/components/camel-mina/src/test/java/org/apache/camel/component/mina/MinaExchangeHolderGateTest.java
@@ -0,0 +1,99 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mina;
+
+import org.apache.camel.Exchange;
+import org.apache.camel.builder.RouteBuilder;
+import org.apache.camel.support.DefaultExchangeHolder;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * {@link DefaultExchangeHolder#unmarshal} rebuilds the whole Exchange from
the payload - id, body, headers (via a
+ * wholesale {@code setHeaders}), out message and every property. The helper
used to do that for any decoded payload
+ * that happened to be a holder, without checking whether the endpoint had
asked for exchange transfer at all.
+ * <p>
+ * Reaching it from the wire additionally requires a widened {@code
objectCodecPattern}, since the object codec's
+ * accept-list refuses an arbitrary class by default - so this is defence in
depth rather than a reachable hole. It
+ * brings camel-mina in line with {@code JmsBinding}, which unmarshals a
holder only on the opted-in path.
+ */
+class MinaExchangeHolderGateTest extends BaseMinaTest {
+
+ private static final String FORGED = "forged-by-the-peer";
+
+ private DefaultExchangeHolder holder() {
+ Exchange source = createExchangeWithBody("holder-body");
+ source.getIn().setHeader("CamelFileName", "../../" + FORGED);
+ source.setProperty(FORGED, Boolean.TRUE);
+ return (DefaultExchangeHolder) DefaultExchangeHolder.marshal(source);
+ }
+
+ @Test
+ void aHolderIsNotUnmarshalledWhenTransferExchangeIsOff() {
+ MinaEndpoint endpoint = context.getEndpoint(uri(""),
MinaEndpoint.class);
+ Exchange target = createExchangeWithBody("original");
+
+ MinaPayloadHelper.setIn(endpoint, target, holder());
+
+ assertThat(target.getIn().getHeader("CamelFileName"))
+ .as("a decoded holder must not rebuild the exchange when
transferExchange is off")
+ .isNull();
+ assertThat(target.getProperty(FORGED)).isNull();
+ assertThat(target.getIn().getBody())
+ .as("it is delivered as an ordinary body instead")
+ .isInstanceOf(DefaultExchangeHolder.class);
+ }
+
+ @Test
+ void aHolderIsStillUnmarshalledWhenTransferExchangeIsOn() {
+ MinaEndpoint endpoint =
context.getEndpoint(uri("&transferExchange=true"), MinaEndpoint.class);
+ Exchange target = createExchangeWithBody("original");
+
+ MinaPayloadHelper.setIn(endpoint, target, holder());
+
+ assertThat(target.getIn().getBody()).isEqualTo("holder-body");
+
assertThat(target.getIn().getHeader("CamelFileName")).isEqualTo("../../" +
FORGED);
+ assertThat(target.getProperty(FORGED)).isEqualTo(Boolean.TRUE);
+ }
+
+ /** setOut follows the same gate. */
+ @Test
+ void setOutFollowsTheSameGate() {
+ MinaEndpoint off = context.getEndpoint(uri(""), MinaEndpoint.class);
+ Exchange target = createExchangeWithBody("original");
+
+ MinaPayloadHelper.setOut(off, target, holder());
+
+ assertThat(target.getMessage().getHeader("CamelFileName")).isNull();
+
assertThat(target.getMessage().getBody()).isInstanceOf(DefaultExchangeHolder.class);
+ }
+
+ private String uri(String extra) {
+ return String.format("mina:tcp://localhost:%1$s?sync=false%2$s",
getPort(), extra);
+ }
+
+ @Override
+ protected RouteBuilder createRouteBuilder() {
+ return new RouteBuilder() {
+ @Override
+ public void configure() {
+ from(uri("")).to("mock:result");
+ }
+ };
+ }
+}
diff --git
a/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
b/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
index f22be188e3a0..a62ff9078fc3 100644
--- a/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
+++ b/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
@@ -71,6 +71,7 @@ public final class SecurityUtils {
map.put("ignoresslverification", new SecurityOption(INSECURE_SSL,
"true"));
map.put("ignoresslwarnings", new SecurityOption(INSECURE_SSL, "true"));
map.put("knownhostsresource", new SecurityOption(INSECURE_SSL, ""));
+ map.put("objectcodecpattern", new
SecurityOption(INSECURE_SERIALIZATION, ""));
map.put("objectmessageenabled", new
SecurityOption(INSECURE_SERIALIZATION, "true"));
map.put("sendenabled", new SecurityOption(INSECURE_DEV, "true"));
map.put("skiptlsverify", new SecurityOption(INSECURE_SSL, "true"));
diff --git
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/MinaComponentBuilderFactory.java
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/MinaComponentBuilderFactory.java
index 7c66053729f2..004c2f122894 100644
---
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/MinaComponentBuilderFactory.java
+++
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/MinaComponentBuilderFactory.java
@@ -491,7 +491,12 @@ public interface MinaComponentBuilderFactory {
/**
* Accept the wildcard specified classes for Object deserialization,
* unless they are otherwise rejected. Multiple patterns can be
- * separated by comma.
+ * separated by comma. This widens the codec's deserialization
+ * allow-list, so keep it as narrow as the route actually needs. Avoid
:
+ * it accepts every class the classpath can load from an untrusted
peer,
+ * including Camel's own org.apache.camel types. Leaving the option
+ * unset is the safest choice - the codec then accepts only the small
+ * built-in set and refuses anything else.
*
* The option is a: <code>java.lang.String</code> type.
*
diff --git
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/MinaEndpointBuilderFactory.java
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/MinaEndpointBuilderFactory.java
index a6b52d6bd721..8256cd16a7d4 100644
---
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/MinaEndpointBuilderFactory.java
+++
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/MinaEndpointBuilderFactory.java
@@ -418,7 +418,12 @@ public interface MinaEndpointBuilderFactory {
/**
* Accept the wildcard specified classes for Object deserialization,
* unless they are otherwise rejected. Multiple patterns can be
- * separated by comma.
+ * separated by comma. This widens the codec's deserialization
+ * allow-list, so keep it as narrow as the route actually needs. Avoid
:
+ * it accepts every class the classpath can load from an untrusted
peer,
+ * including Camel's own org.apache.camel types. Leaving the option
+ * unset is the safest choice - the codec then accepts only the small
+ * built-in set and refuses anything else.
*
* The option is a: <code>java.lang.String</code> type.
*
@@ -1185,7 +1190,12 @@ public interface MinaEndpointBuilderFactory {
/**
* Accept the wildcard specified classes for Object deserialization,
* unless they are otherwise rejected. Multiple patterns can be
- * separated by comma.
+ * separated by comma. This widens the codec's deserialization
+ * allow-list, so keep it as narrow as the route actually needs. Avoid
:
+ * it accepts every class the classpath can load from an untrusted
peer,
+ * including Camel's own org.apache.camel types. Leaving the option
+ * unset is the safest choice - the codec then accepts only the small
+ * built-in set and refuses anything else.
*
* The option is a: <code>java.lang.String</code> type.
*
@@ -1912,7 +1922,12 @@ public interface MinaEndpointBuilderFactory {
/**
* Accept the wildcard specified classes for Object deserialization,
* unless they are otherwise rejected. Multiple patterns can be
- * separated by comma.
+ * separated by comma. This widens the codec's deserialization
+ * allow-list, so keep it as narrow as the route actually needs. Avoid
:
+ * it accepts every class the classpath can load from an untrusted
peer,
+ * including Camel's own org.apache.camel types. Leaving the option
+ * unset is the safest choice - the codec then accepts only the small
+ * built-in set and refuses anything else.
*
* The option is a: <code>java.lang.String</code> type.
*
