oscerd opened a new pull request, #27205:
URL: https://github.com/apache/camel/pull/27205
# CAMEL-25223: camel-jgroups — fail fast when the consumer has no pre-read
deserialization control
## What
Follow-up hardening to CAMEL-24676. The camel-jgroups consumer
Java-deserializes inbound cluster messages via
`org.jgroups.Message.getObject()`. The class check added in CAMEL-24676 runs
*after* JGroups has deserialized the payload, so it is defense-in-depth only —
the controls that take effect *before* deserialization are a JVM-wide
`-Djdk.serialFilter`, the JGroups-native `jgroups.deserialization.filter`
system property, or a channel secured with AUTH/encryption.
This makes the default safe instead of silent:
- **Fail fast:** the consumer now refuses to start on the default,
unauthenticated channel when no pre-read control is configured (no
`-Djdk.serialFilter`, no `jgroups.deserialization.filter`, no
`deserializationFilter` option, and the channel has no
`AUTH`/`SYM_ENCRYPT`/`ASYM_ENCRYPT`). The startup exception points to the
component Security section.
- **Opt out:** a new `acceptAllObjects` consumer/component option (default
`false`) restores the previous behaviour — it bypasses the guard and disables
the post-read class check.
- **Docs:** the Security section now documents
`jgroups.deserialization.filter` as a first-class pre-read mitigation and the
startup guard; a 4.23 upgrade-guide entry describes the changed default and the
opt-in.
## Breaking change
Existing `from("jgroups:...")` consumers on a default channel will fail to
start until the operator configures a pre-read control or sets
`acceptAllObjects=true`. This is intentional (secure-by-default), mirroring how
camel-jms/-sjms disabled object messages by default. It is flagged in the
upgrade guide. If reviewers prefer a WARN-and-start variant over fail-fast, I'm
happy to adjust.
## Tests
- `JGroupsDeserializationStartupGuardTest` — the consumer fails fast without
a pre-read control, and starts with `acceptAllObjects=true`.
- Existing consumer tests opt in via `acceptAllObjects=true` (or an explicit
`deserializationFilter`); producer tests are unaffected.
- All `camel-jgroups` module tests pass.
## Generated
Catalog and endpoint/component DSL regenerated for the new
`acceptAllObjects` option.
_Claude Code on behalf of oscerd_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
