[
https://issues.apache.org/jira/browse/CAMEL-24112?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen reassigned CAMEL-24112:
-----------------------------------
Assignee: Claus Ibsen
> camel-rest-openapi: path parameters leak into the query string when the
> operation has more than one parameter
> -------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24112
> URL: https://issues.apache.org/jira/browse/CAMEL-24112
> Project: Camel
> Issue Type: Bug
> Components: camel-rest-openapi
> Affects Versions: 4.21.0
> Reporter: Federico Mariani
> Assignee: Claus Ibsen
> Priority: Major
> Labels: code-review
>
> h3. Problem
> {{RestOpenApiEndpoint.determineEndpointParameters()}}
> (RestOpenApiEndpoint.java:672-687) tries to skip endpoint URI parameters that
> are operation *path* parameters, so they are not duplicated as query
> parameters (CAMEL-17049). The loop is logically inverted: the entry is
> {{put}} into {{nestedParameters}} *inside* the inner per-operation-parameter
> loop whenever *any* operation parameter is not the clashing path parameter,
> instead of only when *no* parameter clashes. The skip therefore only works
> when the operation has exactly one parameter. The leaked entries become
> {{RestEndpoint.parameters}}, flow into the lenient delegate HTTP endpoint,
> and are appended as literal query parameters to the target URI.
> h3. Failure scenario
> Spec operation {{GET /users/\{userId\}/orders/\{orderId\}}} (two path params,
> no query params), route
> {{to("rest-openapi:spec.json#getOrder?userId=1&orderId=2")}} with the
> camel-http delegate -> request sent is {{GET
> /users/1/orders/2?userId=1&orderId=2}}. Verified by execution against current
> main; a single-path-param operation is handled correctly. APIs with strict
> query validation or signed/canonicalized URLs reject the request. When the
> operation also declares query parameters the leak is masked for camel-http by
> the {{Exchange.REST_HTTP_QUERY}} override, but not for other delegates.
> h3. History
> Introduced verbatim by commit 94847d8c4a84 (CAMEL-17049, "avoid duplicate
> parameters if the param is a path param"). The intent is unambiguous; the
> implementation only works for the 1-parameter case. Not pinned by tests
> ({{RestOpenApiEndpointV3Test.shouldDetermineEndpointParameters}} never
> combines endpoint literals with multi-parameter operations).
> h3. Fix direction
> Compute the clash with {{operation.getParameters().stream().anyMatch(p ->
> "path".equals(p.getIn()) && entry.getKey().equals(p.getName()))}} and {{put}}
> once outside the inner loop. This also resolves the current asymmetry where
> an *empty* (non-null) parameter list drops all endpoint literals while a
> {{null}} list keeps them.
> ----
> _This issue was researched and filed by Claude Code on behalf of [~croway]
> (GitHub: Croway), as part of a deep code review of camel-rest-openapi and
> camel-openapi-java on main (4.22.0-SNAPSHOT). Full findings document
> available on request._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
