oscerd opened a new pull request, #27765: URL: https://github.com/apache/camel/pull/27765
`HttpCommonEndpoint.muteException` carried `@UriParam` with **no `defaultValue`**, so the catalog recorded Java's `false`. The effective default is `true`. ### Why the published value was wrong `HttpCommonComponent` sets it: ```java protected boolean muteException = true; ``` and the components read the URI parameter using *that* as the fallback, then set it on the endpoint — `ServletComponent`, and the same two lines in `JettyHttpComponent`: ```java boolean muteException = getAndRemoveParameter(parameters, "muteException", boolean.class, isMuteException()); ... endpoint.setMuteException(muteException); ``` So the endpoint's Java `false` is always overwritten for an endpoint created the normal way. Three components published the wrong endpoint default: | component | componentProperties | endpoint (before) | |---|---|---| | camel-servlet | true | **false** | | camel-jetty | true | **false** | | camel-atmosphere-websocket | true | **false** | Every other owner of the option already agreed with itself at `true`: coap, coaps, coap+tcp, coaps+tcp, cxf, grpc, knative, mina, netty-http, platform-http, undertow. ### This was never a disclosure Worth saying plainly, since it is a security-relevant option: the runtime already mutes the stack trace, and the published value was the **more** alarming one. The cost is that tooling (Kaoto, the VS Code extension, JBang completion) and the generated component docs told a reader that a failed exchange returns the exception's stack trace by default on these three — inviting either redundant configuration or a security report about behaviour that is not there. Same shape as CAMEL-24891, where the damage was also the catalog contract rather than the runtime. Linked as Related. ### The field as well as the annotation I set `muteException = true` on the field too, so the two agree on every path. That changes the value only for an endpoint constructed **without** going through its component, which today gets `false`. `true` matches the documented default and is the safer of the two — but it is the one behavioural line here, so flagging it rather than burying it. Happy to drop it and leave the annotation alone if you would rather keep this purely metadata. ### Regen Full reactor. The diff is the three catalog JSONs, the three component JSONs and the three endpoint DSL builders — each a single replaced line, plus the DSL javadoc `Default: false` → `Default: true`. I read every `-` line rather than just checking that nothing foreign appeared: nothing was deleted and nothing outside these three components changed. That direction of regen damage is the one CI cannot catch, since it builds the branch merged with main. ### Tests | module | tests | |---|---| | camel-http-common | 48 | | camel-servlet | 110 (2 skipped) | | camel-jetty | 403 (23 skipped) | | camel-atmosphere-websocket | 14 | All green. Found while sweeping server-side components for exception echo — the same pass that confirmed camel-coap's `muteException` gate from CAMEL-25087 is in place and defaults to muted. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
