[
https://issues.apache.org/jira/browse/CAMEL-24186?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-24186 started by Federico Mariani.
------------------------------------------------
> camel-cxf - Umbrella: code-quality & modernization cleanup (July 2026 review)
> -----------------------------------------------------------------------------
>
> Key: CAMEL-24186
> URL: https://issues.apache.org/jira/browse/CAMEL-24186
> Project: Camel
> Issue Type: Improvement
> Components: camel-cxf
> Reporter: Federico Mariani
> Assignee: Federico Mariani
> Priority: Minor
>
> Umbrella tracking *non-bug* code-quality / modernization improvements
> identified during the July 2026 code review of the {{components/camel-cxf/}}
> component family. These are distinct from the functional defects (filed as
> bugs, see the linked CAMEL-24176..24184 cluster) - none change behaviour on
> their own; they improve maintainability, remove dead code, modernize dated
> API usage and harden a few defensive paths.
> An initial PR addresses the safe, behaviour-preserving mechanical subset
> (marked *[batch 1]* below); the remainder are follow-ups.
> h2. Deprecated / dated API usage
> # {{new Locale(contentLanguage)}} in {{DefaultCxfRsBinding}} - deprecated;
> move to {{Locale.of()}} (TODO already present) or {{Locale.forLanguageTag()}}
> (also fixes full tags like {{en-US}}).
> # {{Exchange.getOut()}} in the transport ({{CamelDestination}},
> {{DefaultCxfMessageMapper}}) - use {{getMessage()}} (semantics differ
> slightly; needs care).
> # {{DataFormat.MESSAGE}} deprecated but still handled via {{dealias()}} in
> the SOAP binding - remove once the deprecation window closes.
> # *[batch 1]* {{toUpperCase()}} without a locale in
> {{CxfConverter.toDataFormat}} - use {{Locale.ROOT}} (Turkish-i class).
> h2. Code duplication worth refactoring
> # {{CxfRsProducer}}: {{invokeHttpClient}}/{{invokeAsyncHttpClient}} and
> {{invokeProxyClient}}/{{invokeAsyncProxyClient}} are near-copies, and the two
> {{InvocationCallback}} inner classes duplicate
> {{fail}}/{{shouldHandleError}}/{{handleError}} verbatim (this duplication is
> why the CAMEL-24176 async bug exists in two places).
> # The two RS bean-definition parsers have near-identical {{mapElement}}
> bodies - sharing them also prevents the merge-vs-replace divergence.
> # {{DefaultCxfBinding.findMethod}} is a hand-rolled reflective method finder
> duplicating CXF utilities (the class comment says to replace it).
> h2. Dead code and misleading comments
> # *[batch 1]* No-op out-fault observer wrapper in
> {{CxfConsumer.createServer}} ({{setOutFaultObserver(m ->
> original.onMessage(m))}}) - remove.
> # *[batch 1]* Discarded {{sfb.getResourceClasses();}} call in
> {{CxfRsProducer}} (result thrown away, immediately re-called).
> # *[batch 1]* Write-only {{bf}} field in {{SpringBusFactoryBean}}.
> # *[batch 1]* {{CxfMessageMapper}} Javadoc references a
> {{CxfBeanDestination}} class that does not exist in the module (broken
> {{@link}}).
> # *[batch 1]* Misspelled private constant {{SUSPENED}} in {{CxfRsInvoker}} ->
> {{SUSPENDED}}.
> # {{CamelConduit.getCamelTemplate()/setCamelTemplate()}} + field -
> {{@Deprecated}} and unused (public API removal - needs deprecation
> cycle/upgrade guide).
> # CXF < 2.5.1 compatibility branch ({{!addedBus}}) in the SOAP
> bean-definition parser - deletable.
> # Misleading {{// TODO camelExchange may be null}} in
> {{propagateHeadersFromCamelToCxf}} above a line that would NPE if it were
> true.
> # Stub methods {{markPartialResponse}} (always {{true}}) and
> {{CachedCxfPayload.length()/position()}} (always {{0}}/{{-1}}) - document if
> intentional.
> h2. Silent exception swallowing (fail-loud candidates)
> # {{CxfEndpoint.setCamelContext}}/{{setProperties}} swallow binding
> exceptions with {{LOG.warn}} and a {{// TODO: Why don't we rethrow}} comment.
> # {{SimpleCxfRsBinding.MethodSpec.rememberParameter}} has an empty {{catch
> (Exception e) {}}}.
> # {{CxfHeaderFilterStrategy.extendedFilter}} catches filter exceptions and
> only debug-logs, then proceeds with partially-filtered headers.
> h2. Reflection & encapsulation smells
> # {{AbstractClient.getState()}} via {{setAccessible(true)}} in
> {{DefaultCxfRsBinding}} - use the public {{webClient.getHeaders()}}.
> # {{ReflectionUtils.shallowCopyFieldState(bean, cfb)}} in the Spring RS path
> shares mutable feature/provider/interceptor collections between the template
> bean and every per-address client copy - copy defensively.
> h2. API-shape / option-fidelity gaps
> # {{CxfRsEndpoint.setProviders(List)}} / {{setServiceBeans(List)}} do
> {{addAll}} (append) instead of replace - calling a setter twice accumulates
> duplicates.
> # {{CAMEL_CXF_RS_QUERY_MAP}} is {{Map<String,String>}} - multi-valued query
> parameters cannot be expressed.
> # Media-type structured-suffix matching in the RS data-format provider
> matches {{application/json+v1}} rather than the RFC 6839 form
> {{application/v1+json}}.
> # Order-dependent config: {{BusFactory.setDefaultBus}} only fires if
> {{defaultBus}} was set before {{bus}} during property binding.
> # Blueprint detection by class-name substring
> ({{getClass().getName().contains("blueprint")}}) in {{CxfRsComponent}} - a
> marker interface/registry lookup would be sturdier.
> h2. Security-posture hardening (not vulnerabilities)
> # Document the inherited XXE defense:
> {{DataInInterceptor}}/{{DataOutInterceptor}} delegate XML parsing to the CXF
> Bus {{StaxUtils}} config (the framework does not relax parser defaults) - add
> an explicit comment so a future change does not introduce a local parser.
> # {{setSecurityContext}} ({{DefaultCxfMessageMapper}}) captures the
> {{HttpServletRequest}} in an anonymous {{SecurityContext}}; if the CXF
> message outlives the servlet request (async), {{request.getUserPrincipal()}}
> can throw on a recycled request - snapshot the principal defensively.
> ----
> _Filed by Claude Code (Claude Fable) on behalf of Federico Mariani (GitHub:
> Croway). Non-bug quality/modernization findings from an AI-assisted code
> review of the camel-cxf component family._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
