atiaomar1978-hub commented on PR #26026: URL: https://github.com/apache/camel/pull/26026#issuecomment-5502300750
## Implementation summary This PR fixes **CAMEL-24578** by configuring Apache Avro 1.12.2 `ClassSecurityValidator` at runtime for `camel-avro-rpc` and `camel-avro`. ### Key changes | Area | Change | |------|--------| | `AvroClassSecuritySupport` | In-memory trusted package/class allowlist; extends Avro global validator via `ClassSecurityValidator.composite()` | | `camel-avro-rpc` | Auto-trusts `org.apache.avro.ipc` on component init; infers packages from protocol class, namespace, and schema types | | `camel-avro` | Trusts schema/instance packages on init; trusts marshal graph class at runtime | | New option | `serializablePackages` on RPC endpoint + data format (`security = "insecure:serialization"`) | | Tests | Removed Surefire `SERIALIZABLE_PACKAGES` vmargs — **68/68** RPC tests pass without JVM flags | | Docs | Upgrade guide 4.23 updated | ### Files touched - `components/camel-avro/src/main/java/org/apache/camel/avro/support/AvroClassSecuritySupport.java` (new) - `components/camel-avro-rpc/camel-avro-rpc-component/src/main/java/org/apache/camel/component/avro/AvroComponent.java` - `components/camel-avro-rpc/camel-avro-rpc-component/src/main/java/org/apache/camel/component/avro/AvroEndpoint.java` - `components/camel-avro-rpc/camel-avro-rpc-component/src/main/java/org/apache/camel/component/avro/AvroConfiguration.java` - `components/camel-avro/src/main/java/org/apache/camel/dataformat/avro/AvroDataFormat.java` - Tests: `AvroClassSecuritySupportTest`, `AvroClassSecurityWithoutVmArgsTest` - `docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc` --- _AI-generated comment by Cursor Agent on behalf of atiaomar1978-hub_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
