oscerd opened a new pull request, #26735:
URL: https://github.com/apache/camel/pull/26735
Two defects in `camel-debezium-maven-plugin`, which generates the connector
configuration classes for
the six Debezium components. They share one regeneration, hence one PR; each
fix is its own commit.
## CAMEL-24890 — deprecated options declared as `String` constants are still
generated
`ConnectorConfigFieldsFactory.retrieveDbzFieldWithReflection` resolves the
`@Deprecated` members of the
connector config class to option names. For a `String` constant it ran:
```java
Stream.of(fieldString.split("."))
```
`.` is a regex matching any character, so the array is **empty** —
`"database.server.name".split(".").length == 0`
— and the method returned `""`. The name never entered `deprecatedFields`,
so the option was generated
anyway. (Even with `split("\\.")` it would have returned camelCase, which
never matches the raw config key;
a deprecated `String` constant already holds the raw name, so it is now
returned as is.)
`OracleConnectorConfig` has one deprecated member of each kind, which makes
the effect directly observable:
| upstream `@Deprecated` member | declared type | generated before |
|---|---|---|
| `LOG_MINING_CONTINUOUS_MINE` | `io.debezium.config.Field` | no — filtered
correctly |
| `DEPRECATED_XSTREAM_SERVER_NAME` = `"database.out.server.name"` |
`java.lang.String` | **yes** |
So `debezium-oracle.json` shipped `databaseOutServerName` with
`"deprecated": false` and a description
identical to the current `xstreamOutServerName` — two catalog options for
one setting, the deprecated one
unmarked, due to vanish silently when Debezium drops the constant. It is
removed here, with an
upgrade-guide entry.
## CAMEL-24891 — password options were not marked `secret`
The generator emitted `label`, `defaultValue`, `javaType` and
`@Metadata(required)`, but never `secret`,
so nine password options across the six connectors carried `"secret": false`:
`databasePassword` (db2, mysql, oracle, postgres, sqlserver),
`mongodbPassword`,
`databaseSslKeystorePassword` and `databaseSslTruststorePassword` (mysql),
`databaseSslpassword` (postgres).
The connector already declares which options are passwords through
`ConfigDef.Type.PASSWORD`, and
`ConnectorConfigField` already switches on that type when mapping the Java
type, so `secret = true` now
comes from the same signal.
To be precise about the impact: this was **not** a log leak.
`URISupport.ALL_SECRETS` matches any query
parameter whose *key contains* a sensitive keyword, so
`?databasePassword=...` was already redacted in logs
and JMX. What was wrong is what the catalog told tooling — Kaoto, the VS
Code extension and JBang
completion rendered these as plain text. As a side effect the regeneration
also adds the five new keys to
the generated `SensitiveUtils` list, which tightens masking for the
property-style spellings too.
## Tests
*
`ConnectorConfigFieldsFactoryTest.testIfDetectsDeprecatedFieldsDeclaredAsStringConstants`
— a config
class shaped like the real ones, with a deprecated `Field` and a
deprecated `String` constant.
* `ConnectorConfigFieldTest.testIfPasswordFieldsAreSecret` plus a negative
assertion on the existing case.
* `ConnectorConfigGeneratorTest.testIfPasswordFieldsAreMarkedAsSecret` —
generates the real MySQL config
and asserts `databasePassword` is secret while `databaseUser` is not.
Both fixes were verified by reverting them and re-running: each new test
then fails on its own assertion,
so neither passes by construction. Plugin suite green (32 tests), full
reactor
`mvn clean install -DskipTests -DskipITs` green.
_Claude Code on behalf of oscerd_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
