gnodet-bot commented on code in PR #26267:
URL: https://github.com/apache/camel/pull/26267#discussion_r3980967854
##########
components/camel-jgroups/src/main/java/org/apache/camel/component/jgroups/JGroupsEndpoint.java:
##########
@@ -55,6 +57,15 @@ public class JGroupsEndpoint extends DefaultEndpoint {
private String channelProperties;
@UriParam(label = "consumer")
private boolean enableViewMessages;
+ @UriParam(label = "consumer,security",
+ description = "Restricts the Java classes accepted when a
message received from the cluster is"
+ + " deserialized. The value is a JEP-290
ObjectInputFilter pattern; the type of the"
+ + " message body is checked against it before the
exchange is routed, and a rejected"
+ + " type is refused. This is a defense-in-depth
allow-list applied after JGroups has"
+ + " deserialized the message: the primary
mitigations remain a JVM-wide jdk.serialFilter"
+ + " and a JChannel secured with AUTH and
encryption. When not set, no additional class"
+ + " check is performed.")
+ private String deserializationFilter;
Review Comment:
🔴 **Compilation error (still unfixed from previous review):**
`resolvedDeserializationFilter` is used in `checkDeserializedType()` (lines
105–108) but never declared as a field. Add the field declaration here:
```suggestion
private String deserializationFilter;
private ObjectInputFilter resolvedDeserializationFilter;
```
Additionally, since `createExchange(Message)` is called from JGroups'
receiver thread pool, lazy initialization of `resolvedDeserializationFilter`
without synchronization is a data race. The safer pattern is to resolve the
filter eagerly in `doStart()` — this matches the lifecycle pattern used by
other Camel components (`camel-jms`, `camel-sjms`). If you prefer lazy init,
the field must be `volatile`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
