oscerd opened a new pull request, #26268:
URL: https://github.com/apache/camel/pull/26268
Gates the SQL query/template override headers behind an opt-in flag (default
`false`), matching the
`allowTemplateFromHeader` convention already used by the template components
(camel-freemarker, camel-velocity,
camel-xslt, ...).
## Change
- **camel-sql**: `CamelSqlQuery` no longer overrides the endpoint query by
default. New `allowQueryFromHeader`
option (default `false`) restores it.
- **camel-sql-stored**: `CamelSqlStoredTemplate` no longer overrides the
endpoint template by default. New
`allowTemplateFromHeader` option (default `false`) restores it, and a
header-supplied template is now resolved
with property placeholders only — never through `SqlHelper.resolveQuery` →
`ResourceHelper`, which would
resolve `file:` / `http:` schemes (SSRF / file read).
## ⚠️ Draft — two things to resolve
1. **PMC decision on the default.** This gates a *currently-honoured*
header, which is a behavioural change. The
default is proposed as `false` (deny-by-default, per the security model
and the sibling components), but this
issue was explicitly filed for discussion on exactly this default. The
4.23 upgrade-guide entry documents the
migration (`allow…FromHeader=true`).
2. **Endpoint/component DSL regeneration is pending.** The two new
`@UriParam` options require regenerating the
`Sql`/`SqlStored` `EndpointBuilderFactory` / `ComponentBuilderFactory`
under `dsl/`. I could not run the full
reactor build locally because `camel-langchain4j-embeddings`' 83 MB model
jar
(`dev.langchain4j:langchain4j-embeddings-all-minilm-l6-v2`) would not
download (repeated read timeouts), which
blocks the `dsl/` modules from compiling. A `mvn clean install` in an
environment with that jar (e.g. CI) will
regenerate them. The component-local catalog/config metadata (`sql.json`,
`sql-stored.json`, the
`*Configurer` / `*UriFactory`) **is** regenerated and included here.
## Scope
Addresses the camel-sql and camel-sql-stored parts of CAMEL-24292. The
**camel-xslt** `CamelXsltFileName` gate is
deferred: the xslt `FileResultHandlerFactory` is shared by **camel-xj**
(JSON2XML `output=file`), and camel-xj
additionally has its own `JsonFileResultHandlerFactory` reading the same
header ungated — so hardening the XSLT
file-output header needs a separate, wider change across both components.
## Tests
- camel-sql: `SqlRouteTest` / `SqlTransactedRouteTest` updated to opt in;
new `testQueryFromHeaderIsIgnoredByDefault`
proves the default-off gate. All camel-sql tests pass locally.
- camel-sql-stored: new `SqlStoredAllowTemplateFromHeaderTest` proves the
`CamelSqlStoredTemplate` header is
ignored by default.
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
