atiaomar1978-hub commented on code in PR #25846:
URL: https://github.com/apache/camel/pull/25846#discussion_r3890149607
##########
docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc:
##########
@@ -13,6 +13,20 @@ See the xref:camel-upgrade-recipes-tool.adoc[documentation]
page for details.
== Upgrading Camel 4.22 to 4.23
+=== camel-exec
+
+`allowControlHeaders` is now annotated `security = "insecure:dev"`.
+With `camel.main.profile = prod` the default policy for that category is
`fail`,
+so an endpoint or component that sets `allowControlHeaders=true` will not start
+unless you relax `camel.security.insecureDevPolicy`.
+
+When the flag is `false` (the default), any remaining `CamelExecCommand*`,
+`CamelExecExitValues`, or `CamelExecUseStderrOnEmptyStdout` headers are ignored
+and a WARN is logged once per binding instance. Those headers never overrode
the
+URI without the flag; they were just silent before.
+
+=== Components removal
+
Review Comment:
Fixed in `a9875fc15a4` — removed the duplicate empty `=== Components
removal` heading. The upgrade guide now goes directly from the `camel-exec`
section to `=== Components and Language removal`.
_AI-generated reply on behalf of atiaomar1978-hub (Cursor Cloud Agent)_
##########
components/camel-exec/src/test/java/org/apache/camel/component/exec/ExecProducerTest.java:
##########
@@ -67,6 +67,25 @@ public void testWithContextConfiguration() {
assertEquals("mockedByCommandExecutorMock.exe",
execCommandExecutorMock.lastCommandResult.getCommand().getExecutable());
}
+ @Test
+ @DirtiesContext
+ public void testIgnoreControlHeadersByDefault() {
+ final String command = "java";
+
+ producerTemplate.send(new Processor() {
+
+ public void process(Exchange exchange) {
+ exchange.getIn().setBody("noinput");
+ exchange.getIn().setHeader(EXEC_COMMAND_EXECUTABLE, command);
+ exchange.getIn().setHeader(EXEC_COMMAND_ARGS,
Arrays.asList("-version"));
+ }
+ });
+
+ assertEquals("mockedByCommandExecutorMock.exe",
+
execCommandExecutorMock.lastCommandResult.getCommand().getExecutable());
+
assertTrue(execCommandExecutorMock.lastCommandResult.getCommand().getArgs().isEmpty());
Review Comment:
Acknowledged — left the new test on JUnit assertions (`assertEquals`,
`assertTrue`) to match the rest of this file, which already uses JUnit
consistently throughout. Happy to migrate the whole file to AssertJ in a
follow-up if preferred.
_AI-generated reply on behalf of atiaomar1978-hub (Cursor Cloud Agent)_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
