gnodet-bot commented on code in PR #26664:
URL: https://github.com/apache/camel/pull/26664#discussion_r4061652116
##########
components/camel-opa/src/main/java/org/apache/camel/component/opa/OpaPolicyEvaluator.java:
##########
@@ -233,6 +237,9 @@ private static void clearDecisionHeaders(Exchange exchange)
{
message.removeHeader(OpaConstants.DECISION_ALLOW);
message.removeHeader(OpaConstants.DECISION);
message.removeHeader(OpaConstants.POLICY_PATH);
+ // as attacker-settable as the verdict itself: left in place, a sender
could preload it false and make a
+ // fail-open read as a decision a policy actually made
+ message.removeHeader(OpaConstants.DECISION_FAILED_OPEN);
Review Comment:
⚠️ **Missing companion guard in `isDecisionHeader()`**
`DECISION_FAILED_OPEN` is now a decision header — its presence is the audit
signal this PR is adding, and a Rego policy that reads it from the
`input.headers` document would silently see a stale sender-injected value on a
second evaluation in a pipeline (where the header hasn't been cleared yet
between exchanges). `clearDecisionHeaders()` removing it here is the runtime
protection, but `isDecisionHeader()` is the code-level contract:
```java
private static boolean isDecisionHeader(String name) {
return OpaConstants.DECISION_ALLOW.equalsIgnoreCase(name)
|| OpaConstants.DECISION.equalsIgnoreCase(name)
|| OpaConstants.POLICY_PATH.equalsIgnoreCase(name)
|| OpaConstants.DECISION_FAILED_OPEN.equalsIgnoreCase(name);
}
```
The comment in `buildInput()` (line 150) says "never feed our own decision
headers back in" — `DECISION_FAILED_OPEN` is one of them and should be listed
here too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
