oscerd commented on code in PR #26268:
URL: https://github.com/apache/camel/pull/26268#discussion_r4013996742
##########
components/camel-sql/src/main/java/org/apache/camel/component/sql/stored/SqlStoredProducer.java:
##########
@@ -106,15 +106,27 @@ public void execute(StatementWrapper ps) throws
SQLException, DataAccessExceptio
private StatementWrapper createStatement(Exchange exchange) throws
SQLException {
String sql;
+ boolean fromHeader = false;
if (getEndpoint().isUseMessageBodyForTemplate()) {
sql = exchange.getIn().getBody(String.class);
} else {
- String templateHeader =
exchange.getIn().getHeader(SqlStoredConstants.SQL_STORED_TEMPLATE,
String.class);
- sql = templateHeader != null ? templateHeader : resolvedTemplate;
+ String templateHeader = getEndpoint().isAllowTemplateFromHeader()
+ ?
exchange.getIn().getHeader(SqlStoredConstants.SQL_STORED_TEMPLATE,
String.class) : null;
+ if (templateHeader != null) {
+ sql = templateHeader;
+ fromHeader = true;
+ } else {
+ sql = resolvedTemplate;
+ }
}
try {
- sql = SqlHelper.resolveQuery(getEndpoint().getCamelContext(), sql,
null);
+ // A header-supplied template is untrusted input, so it must not
be resolved as a file:/http: resource
+ // (SqlHelper.resolveQuery -> ResourceHelper does that) - resolve
placeholders only. The endpoint-configured
+ // template is already resolved in doInit/doStart.
+ sql = fromHeader
+ ? SqlHelper.resolvePlaceholders(sql, null)
+ : SqlHelper.resolveQuery(getEndpoint().getCamelContext(),
sql, null);
} catch (Exception e) {
Review Comment:
Good catch — and as you note, this is pre-existing: the endpoint-template
branch already re-resolved `resolvedTemplate` through `resolveQuery` on every
exchange before this PR. It's harmless (the already-resolved string has no
scheme prefix), so I'm keeping this PR scoped to the header/body gating and
leaving the short-circuit micro-optimization for a separate cleanup.
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
##########
docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc:
##########
@@ -1864,3 +1864,21 @@ Documents carrying an internal DTD subset still parse.
To restore the previous behaviour and allow external entity resolution, set
the new
`allowExternalEntities` option to `true` on the data format or on the endpoint
(`smooks:config.xml?allowExternalEntities=true`).
+
+=== camel-sql, camel-sql-stored - the query/template override headers are gated
+
+A message header could override the endpoint-configured SQL by default,
letting an incoming message choose the
+executed statement:
+
+* `camel-sql`: the `CamelSqlQuery` header replaced the endpoint query.
+* `camel-sql-stored`: the `CamelSqlStoredTemplate` header replaced the
endpoint template, and its value was
+ resolved through `SqlHelper.resolveQuery`, which resolves `file:` / `http:`
/ `classpath:` resources.
Review Comment:
The guide's fuller list (`file:`/`http:`/`classpath:`) is the accurate one —
`resolveQuery` -> `ResourceHelper.hasScheme` covers those (and more). The
endpoint `@UriParam` tooltip abbreviates to `file:/http:`; rather than re-spin
the generated json/DSL just to widen the tooltip after the PR is approved and
green, I'll align the tooltip wording in a follow-up.
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
