gnodet commented on code in PR #26187:
URL: https://github.com/apache/camel/pull/26187#discussion_r3956331185
##########
components/camel-opa/src/main/java/org/apache/camel/component/opa/OpaPolicyEvaluator.java:
##########
@@ -120,6 +124,19 @@ protected Map<String, Object> buildInput(Exchange
exchange) {
}
}
input.put("headers", headers);
+ if (includesAnything(includedProperties)) {
+ Map<String, Object> properties = new LinkedHashMap<>();
+ for (Map.Entry<String, Object> entry :
exchange.getProperties().entrySet()) {
+ if (!isIncluded(includedProperties, entry.getKey())) {
+ continue;
+ }
+ Object value = toJsonSafe(exchange, entry.getValue());
+ if (value != null) {
+ properties.put(entry.getKey(), value);
+ }
+ }
+ input.put("properties", properties);
+ }
Review Comment:
⚠️ **Bug:** `"properties"` is added to the input document even when the
collected map is empty — e.g., when
`includeProperties=CamelKeycloakTokenSubject` is configured but the exchange
carries no such property. A Rego policy that checks `has(input, "properties")`
will see `true` even though the intended identity is absent, which can produce
a silent incorrect authorization decision.
The `headers` key is always present by design (existing contract).
`properties` should only appear when there is actually something to send:
```suggestion
if (includesAnything(includedProperties)) {
Map<String, Object> properties = new LinkedHashMap<>();
for (Map.Entry<String, Object> entry :
exchange.getProperties().entrySet()) {
if (!isIncluded(includedProperties, entry.getKey())) {
continue;
}
Object value = toJsonSafe(exchange, entry.getValue());
if (value != null) {
properties.put(entry.getKey(), value);
}
}
if (!properties.isEmpty()) {
input.put("properties", properties);
}
}
```
Also needs a corresponding test: `includeProperties=subject` with an
exchange that has no `subject` property → `input` must not contain the
`"properties"` key.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
