gnodet commented on code in PR #26009: URL: https://github.com/apache/camel/pull/26009#discussion_r3905216772
########## core/camel-support/src/main/java/org/apache/camel/support/KeyValueRepositoryHelper.java: ########## @@ -0,0 +1,125 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.camel.support; + +import java.io.ByteArrayInputStream; +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.ObjectInputStream; +import java.io.ObjectOutputStream; +import java.nio.ByteBuffer; + +import org.apache.camel.RuntimeCamelException; + +/** + * Shared serialization utilities for {@link org.apache.camel.spi.KeyValueRepository} implementations. + * <p/> + * All persistent {@code KeyValueRepository} implementations need to serialize arbitrary Java objects to bytes (for BLOB + * columns, Kafka messages, etc.) and deserialize them back. This helper centralises that logic to avoid the same + * try/catch boilerplate in every implementation. + * <p/> + * <b>Security note:</b> These methods use plain Java serialization + * ({@link ObjectOutputStream}/{@link ObjectInputStream}). The stored data is trusted — it was written by the same + * application instance or cluster. Do not expose a repository's raw byte store to untrusted input. + * + * @since 4.23 + */ +public final class KeyValueRepositoryHelper { + + private KeyValueRepositoryHelper() { + // utility class + } + + /** + * Serializes an object to a byte array using Java object serialization. + * + * @param value the object to serialize (must be {@link java.io.Serializable}) + * @return the serialized bytes + * @throws RuntimeCamelException if serialization fails + */ + public static byte[] serialize(Object value) { Review Comment: _Claude Code on behalf of @luigidemasi_ `KeyValueRepositoryHelper` provides shared serialize/deserialize utilities for the persistent `KeyValueRepository` backends (JDBC, JPA, Cassandra, Kafka) in the follow-up PR #25993. All four implementations were duplicating the same `ObjectOutputStream`/`ObjectInputStream` boilerplate — this helper centralises it in `camel-support` so they all delegate here. We need to store arbitrary Java objects because of the use cases this SPI supports: - **Cache EIP** — caches arbitrary expression results (not just strings) - **KeyValueAggregationRepository** — stores `DefaultExchangeHolder` (body, headers, properties — all arbitrary Java objects) Narrowing to `String` would force JSON serialization for these, but `DefaultExchangeHolder` contains arbitrary objects in headers and body — JSON can't faithfully round-trip them (type fidelity loss, custom POJOs, etc.). This is the same approach used by `JdbcCamelCodec` and `CassandraCamelCodec` in the existing `AggregationRepository` implementations for the same reason — they also serialize `DefaultExchangeHolder` via `ObjectOutputStream`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
