oscerd opened a new pull request, #1912:
URL: https://github.com/apache/camel-spring-boot/pull/1912
CAMEL-23378 (`52b017db006`) added this guard to
`SpringTypeConverter.convertTo()`:
```java
// do not attempt to convert String -> InputStream (or subclasses like
FileInputStream).
// Spring's ObjectToObjectConverter finds FileInputStream(String)
constructor and treats
// the String value as a file path instead of data content.
if (value instanceof String && InputStream.class.isAssignableFrom(type)) {
return null;
}
```
The reasoning generalises: Spring's `ObjectToObjectConverter` will find
*any* single-String constructor, and
several of them take a path. Only `InputStream` was covered.
### What actually happens without the guard
Measured by running the new tests against `main`:
| target | behaviour on `main` |
|---|---|
| `FileWriter` | **conversion succeeds** — `expected <null> but was
<java.io.FileWriter@...>`. `FileWriter(String)` **creates the named file on
disk.** |
| `FileReader` | throws `ConversionFailedException` — Camel's own converters
never get a chance |
| `ZipFile` | throws `ConversionFailedException` — same |
The `FileWriter` case is the notable one: a String body is not merely
misread as a path, it causes a file to be
created (and truncated, if it already exists).
### Change
`Reader`, `Writer` and `ZipFile` join `InputStream` in the guard, extracted
into a small
`isFileBackedTarget(Class<?>)` helper.
**`java.io.File` is deliberately not included.** `String` → `File` is a
documented Spring conversion where the
String genuinely *is* a path, and blocking it would break legitimate use.
There is a test pinning that it still
works, so the guard cannot quietly grow to swallow it.
The scan this came from suggested inverting to an allowlist of safe target
types. I did not do that — it would
be a much larger behaviour change across every `String` conversion this
converter handles, and it is not
needed to close the hazard. Worth considering separately if the denylist
keeps growing.
### Tests
Five added to `SpringTypeConverterTest`, following the shape of the two
CAMEL-23378 added:
- `FileReader`, `Reader`, `FileWriter` and `ZipFile` targets are blocked
- the `FileWriter` case additionally asserts no file appears on disk
- `String` → `File` still converts
Verified meaningful: the three hazard tests fail against `main` (1 failure,
2 errors); the `File` test passes
either way as a regression guard. Full `core/camel-spring-boot` suite: 143
tests, 0 failures. Root reactor
build green.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
