Andrea Cosentino created CAMEL-24193:
----------------------------------------
Summary: camel-aws-secrets-manager: SQS-notification
secret-refresh NPEs on missing queue and never drains the queue
Key: CAMEL-24193
URL: https://issues.apache.org/jira/browse/CAMEL-24193
Project: Camel
Issue Type: Bug
Components: camel-aws
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.14.9, 4.22.0, 4.18.4
In the SQS-notification branch of CloudTrailReloadTriggerTask (the
aws-secret-refresh task with useSqsNotification=true):
1. *NPE on a receive failure.* {{QueueDoesNotExistException}} from
{{sqsClient.receiveMessage(...)}} is caught and only logged, leaving
{{messageResult}} null, which is then dereferenced by {{for (Message message :
messageResult.messages())}} — every poll throws NPE (swallowed by the outer
catch and logged as an error). Any transient receive failure that leaves
messageResult null has the same effect. Code ~lines 324-332.
2. *Queue is never drained.* {{deleteMessage}} runs only inside {{if
(matchSecret) { if (isReloadEnabled()) { ... } }}} and the loop {{break}}s on
the first match. Non-matching messages, and all messages when
reloadEnabled=false, are never deleted and are redelivered on every poll
(unbounded queue growth / cost); only the first matching message in a batch is
handled. Code ~lines 347-360.
3. *ObjectMapper allocated per message* inside the loop (~line 333) instead of
reused.
Fix direction: guard against a null receive result; parse with a single reused
ObjectMapper; process every message in the batch and delete each one after
examining it (matched -> record update / trigger reload; unmatched or malformed
-> discard) so the queue is drained. A malformed message body should be logged
and discarded rather than aborting the whole batch.
Not changing here (noted for follow-up): the CloudTrail-polling branch advances
its cursor by newest-event-time + 1000ms (can skip same-second events), and
matchSecret uses substring contains() (over-broad) — both are
behavior-sensitive and out of scope.
Present on camel-4.18.x and camel-4.14.x; backport to both.
Found during an agent-assisted audit of the AWS components; verified against
the cited code.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
