oscerd commented on code in PR #27205:
URL: https://github.com/apache/camel/pull/27205#discussion_r4163844596
##########
components/camel-jgroups/src/main/java/org/apache/camel/component/jgroups/JGroupsEndpoint.java:
##########
@@ -153,6 +167,53 @@ private ObjectInputFilter resolveDeserializationFilter() {
deserializationFilter,
DeserializationFilterHelper.DEFAULT_CLASS_DESERIALIZATION_FILTER);
}
+ /**
+ * Verifies, at consumer start, that inbound cluster messages will not be
Java-deserialized without a pre-read
+ * protection in place. JGroups materializes the message body with {@code
ObjectInputStream.readObject()} inside its
+ * own receive path, before Camel can inspect the result, so the post-read
{@link #deserializationFilter} check is
+ * defense-in-depth only. A pre-read control is considered present when
any of the following holds: a JVM-wide
+ * serialization filter ({@code -Djdk.serialFilter}) is configured, the
JGroups
+ * {@code jgroups.deserialization.filter} system property is set, the
{@code deserializationFilter} option is
+ * configured, or the channel protocol stack includes
authentication/encryption. Set {@link #acceptAllObjects} to
+ * {@code true} to start anyway and accept any type, restoring the
previous behaviour.
+ *
+ * @throws JGroupsException if none of the above is configured on the
(unauthenticated) default channel
+ */
+ void verifyConsumerDeserializationGuard() {
+ if (acceptAllObjects) {
+ return;
+ }
+ if (deserializationFilter != null && !deserializationFilter.isBlank())
{
Review Comment:
Fixed in the latest push. Dropped the `deserializationFilter` branch from
`verifyConsumerDeserializationGuard()` — only a JVM-wide `-Djdk.serialFilter`,
the `jgroups.deserialization.filter` system property, or an
`AUTH`/`SYM_ENCRYPT`/`ASYM_ENCRYPT` channel satisfy the guard now. Updated the
component doc's "Startup guard" list and the 4.23 upgrade guide to match, and
reworked `JGroupsDefaultDeserializationFilterTest` so it satisfies the guard
via the JGroups property rather than `deserializationFilter`.
_Claude Code on behalf of oscerd_
##########
components/camel-jgroups/src/main/java/org/apache/camel/component/jgroups/JGroupsEndpoint.java:
##########
@@ -68,6 +72,16 @@ public class JGroupsEndpoint extends DefaultEndpoint {
+ " java.**, javax.** and org.apache.camel.** is
applied. Use * to accept any type.")
private String deserializationFilter;
+ @UriParam(label = "consumer,security", defaultValue = "false",
+ description = "Whether to start the consumer and accept any
object deserialized from the cluster even"
+ + " when no pre-read deserialization control is
configured. When false (the default) the"
+ + " consumer fails to start on an unauthenticated
default channel unless a JVM-wide"
+ + " -Djdk.serialFilter, the JGroups
jgroups.deserialization.filter system property, the"
+ + " deserializationFilter option, or an
authenticated/encrypted channel is configured. Set"
+ + " to true to restore the previous behaviour of
accepting any serialized type; this also"
+ + " disables the post-read class check.")
+ private boolean acceptAllObjects;
Review Comment:
Fixed — added `security = "insecure:serialization"` to the
`acceptAllObjects` `@UriParam` (endpoint) and `@Metadata` (component). The
full-reactor regen propagated it into `SecurityUtils` (`acceptallobjects` →
`INSECURE_SERIALIZATION`, owner `component:jgroups`), so
`camel.main.profile=prod` now rejects it; catalog JSON and DSL were regenerated
too.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
