oscerd opened a new pull request, #26208:
URL: https://github.com/apache/camel/pull/26208
# Description
The CoAP consumer maps the URI query parameters of an incoming request into
Exchange headers (`CamelCoapResource#handleRequest`), running each one through
the endpoint `HeaderFilterStrategy` first. `CoAPEndpoint` defaults to
`DefaultHeaderFilterStrategy`, whose `inFilterStartsWith` is `{"Camel",
"camel"}` with `lowerCase = true`, so names starting with `Camel` are filtered
whatever casing the peer uses.
That behaviour is correct today, but it is not covered by any test in
`camel-coap`. A refactoring of the consumer could silently drop the filter
call, which is exactly the regression the CVE-2025-27636 family was about.
This is a **test-only** change — no production code is modified.
## Changes
- Added `CoAPHeaderInjectionTest`: sends CoAP requests carrying a Camel
internal header name as a URI query parameter in four casings
(`CamelBeanMethodName`, `camelBeanMethodName`, `caMELBeanMethodName`,
`CAMELBEANMETHODNAME`) and asserts the header is never mapped onto the
Exchange, while an ordinary query parameter still is.
The assertion relies on the Camel header map being case-insensitive, so a
single lookup per request catches any spelling that may have slipped through.
## Testing
- `mvn install -pl components/camel-coap` — 67 tests, all green.
- Verified the test is a real guard, not a vacuous one: with the
`applyFilterToExternalHeaders` call in `CamelCoapResource` removed, it fails
with `expected: <null> but was: <malicious>`.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
