gnodet-bot commented on code in PR #26267:
URL: https://github.com/apache/camel/pull/26267#discussion_r3980964256
##########
components/camel-jgroups/src/main/java/org/apache/camel/component/jgroups/JGroupsEndpoint.java:
##########
@@ -55,6 +57,15 @@ public class JGroupsEndpoint extends DefaultEndpoint {
private String channelProperties;
@UriParam(label = "consumer")
private boolean enableViewMessages;
+ @UriParam(label = "consumer,security",
+ description = "Restricts the Java classes accepted when a
message received from the cluster is"
+ + " deserialized. The value is a JEP-290
ObjectInputFilter pattern; the type of the"
+ + " message body is checked against it before the
exchange is routed, and a rejected"
+ + " type is refused. This is a defense-in-depth
allow-list applied after JGroups has"
+ + " deserialized the message: the primary
mitigations remain a JVM-wide jdk.serialFilter"
+ + " and a JChannel secured with AUTH and
encryption. When not set, no additional class"
+ + " check is performed.")
+ private String deserializationFilter;
Review Comment:
🔴 **Compilation error (still present from previous review):**
`resolvedDeserializationFilter` is used in `checkDeserializedType()` but the
field is never declared. Add it here:
```suggestion
private String deserializationFilter;
private ObjectInputFilter resolvedDeserializationFilter;
```
Note: since `createExchange(Message)` can be called from JGroups' receiver
thread pool, the lazy init of `resolvedDeserializationFilter` in
`checkDeserializedType()` is racy. Consider resolving eagerly in `doStart()`
instead — this is also the pattern used by `camel-jms` and `camel-sjms`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
