oscerd opened a new pull request, #1913:
URL: https://github.com/apache/camel-spring-boot/pull/1913
`CamelSecurityPolicyAutoConfiguration.extractCamelProperties()` collects the
properties the `camel.security`
policy framework (CAMEL-23250) evaluates, filtering on the name exactly as
the source reports it:
```java
if (name != null && name.startsWith("camel.") &&
!name.startsWith("camel.security.")) {
```
Property sources report names in their own form. An option set in
`application.properties` arrives as
`camel.component.http.trustAllCertificates`; the *same option* set as an
environment variable arrives as
`CAMEL_COMPONENT_HTTP_TRUSTALLCERTIFICATES`, which never matches the
`camel.` prefix — even though Spring's
relaxed binding applies it to the component just the same.
So every Camel option configured through the environment escaped the policy
check. That is the usual way to
configure a containerised application, so the check was blind to a large
part of real deployments.
### Change
Names are canonicalized with Spring Boot's own
`ConfigurationPropertyName.adapt(name, '_')` before the prefix
test, and the canonical name is used for the value lookup so relaxed binding
resolves it back to the variable.
This works end to end because `SecurityUtils.getSecurityOption` already
takes the last segment, lowercases it
and strips dashes — so the canonical
`camel.component.http.trustallcertificates` resolves to the same
`trustallcertificates` option as the camelCase form. No change was needed on
the camel-core side.
`camel.security.*` stays excluded, in both forms.
### Tests
Two added to `CamelSecurityPolicyAutoConfigurationTest`, injecting a real
`SystemEnvironmentPropertySource` so
the name arrives in native form rather than being pre-normalised by the test:
- `policyShouldSeeInsecureOptionsSetThroughTheEnvironment` —
`CAMEL_COMPONENT_HTTP_TRUSTALLCERTIFICATES=true`
now raises a violation, and the reported `propertyKey` is the canonical
name
- `environmentVariablesUnrelatedToCamelAreIgnored` — a non-Camel variable
whose last segment happens to be a
security option name (`SOME_OTHER_TRUSTALLCERTIFICATES`) must not raise one
Verified meaningful: the first fails against `main` (no violation detected),
the second passes either way as a
negative control. Full `core/camel-spring-boot` suite: 140 tests, 0
failures. Root reactor build green.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
