atiaomar1978-hub commented on PR #26026: URL: https://github.com/apache/camel/pull/26026#issuecomment-5512138775
## Croway + davsclaus review feedback addressed — rebased on `main` _AI-generated comment by Cursor Agent on behalf of @atiaomar1978-hub_ Latest commits rebase this PR onto current `main` (`69f78c23799`) and address all six inline findings from @Croway plus remaining items from @davsclaus / @gnodet. ### Croway findings — fixed | # | Issue | Fix | |---|-------|-----| | 1 | JDK packages leak via reflection protocol error types | `trustProtocol()` skips `type.isError()` schemas; `isSystemPackage()` filters `java.*`/`javax.*`/`jdk.*`/`sun.*` | | 2 | Schema-less marshal trusts body package before validation | Marshal now calls `loadSchema()` first; only then `trustClassNameOnly()` (exact class, no package) | | 3 | Later `setGlobal()` silently discarded | `refreshGlobal()` re-adopts `getGlobal()` when it differs from `installedGlobal` | | 4 | Non-named root schemas fail at startup | `trustSchema()` walks graph; ARRAY/UNION/MAP roots no longer call `getNamespace()` | | 5 | Prefix matching shadows parent packages | Iterate all normalized prefixes instead of single `lower()` lookup | | 6 | Nested named types not trusted on unmarshal | `trustSchema()` / `trustProtocol()` walk fields, array items, map values, union branches | ### Other review items - Removed redundant `ensureAvroIpcPackagesTrusted()` from endpoint (component init only) - Excluded `serializablePackages` from Jackson Avro catalog metadata (`avroJackson` / `avroJackson3`) - Expanded unit tests (prefix matching, global validator preservation, non-named schemas, JDK filtering) ### Tests ```bash mvn test -pl components/camel-avro,components/camel-avro-rpc/camel-avro-rpc-component ``` All unit tests pass without Surefire `SERIALIZABLE_PACKAGES` vmargs. Ready for re-review. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
