[
https://issues.apache.org/jira/browse/CAMEL-24159?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18097197#comment-18097197
]
Claus Ibsen commented on CAMEL-24159:
-------------------------------------
camel-azure-storage-datalake fix merged via
https://github.com/apache/camel/pull/24871
> camel-azure - Umbrella: medium-severity findings from July 2026 review (incl.
> cross-module credentialType override)
> -------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24159
> URL: https://issues.apache.org/jira/browse/CAMEL-24159
> Project: Camel
> Issue Type: Bug
> Components: camel-azure, camel-azure-eventhubs,
> camel-azure-servicebus
> Reporter: Federico Mariani
> Assignee: Claus Ibsen
> Priority: Minor
> Labels: review-2026-07
> Fix For: 4.22.0
>
> Attachments: camel-azure-review-2026-07.md
>
>
> Umbrella for the medium-severity findings of the July 2026 review of the
> camel-azure flagship components on main (4.22.0-SNAPSHOT). Full findings
> document attached; low-severity findings are listed in the document only.
> *Cross-cutting (all five modules)* — the CAMEL-21871 credential autowiring
> silently overrides an *explicitly configured* {{credentialType}}:
> # blob {{BlobComponent:84-97}} — autowired StorageSharedKeyCredential
> clobbers explicit {{credentialType=AZURE_SAS}}.
> # servicebus {{ServiceBusComponent:59-68}} +
> {{ServiceBusClientFactory:45-49}} — additionally a user-supplied
> DefaultAzureCredential (managedIdentityClientId, tenant...) is discarded and
> a fresh DefaultAzureCredentialBuilder().build() used instead.
> # eventhubs {{EventHubsComponent:52-66}} — autowired TokenCredential
> overrides explicit CONNECTION_STRING and produces a misleading "Namespace and
> EventHub name must be set" startup error.
> # storage-queue {{QueueComponent:69-78}} — same override; QueueClientFactory
> also prefers the credential's accountName over the URI's (wrong storage
> account).
> # storage-datalake {{DataLakeComponent:66-82}} +
> {{DataLakeClientFactory:42-67}} — same override; additionally plain
> {{accountKey}}/{{sasSignature}} (as used in the component doc examples) are
> not mapped to a credential type -> baffling ClientSecretCredential startup
> error, and the factory silently returns a null client on missing secrets
> (obscure NPE at first poll).
> Suggested direction: only derive/override credentialType when the user did
> not set it explicitly; map accountKey/sasSignature to the matching type.
> *camel-azure-servicebus*
> # {{ServiceBusConsumer:73-107,137-154}} — route stop/start leaks the
> processor client (doStart recreates unconditionally; doStop per CAMEL-23260
> only calls stop()) and accumulates lock-renewal period tasks.
> # {{ServiceBusProducer:101-108}} / {{ServiceBusConsumer:167-170}} —
> user-provided (and autowired) sender/processor clients are closed by the
> endpoint on stop; same pattern in eventhubs {{EventHubsProducer:41-69}}.
> # {{ServicebusCloudEventDataTypeTransformer:54-56}} — CE content type set to
> Boolean {{true}} ({{containsKey}} result) instead of the header value (since
> CAMEL-20450).
> # {{ServiceBusProducer:126-132,224-231}} — producer mutates the
> user/consumer-supplied APPLICATION_PROPERTIES map in place
> (UnsupportedOperationException on immutable maps; retroactively mutates the
> received message when bridging).
> # {{ServiceBusConsumer:122-123}} — maxConcurrentCalls provides no
> backpressure for async routes; unbounded in-flight growth, then mass
> duplicates once lock-renewal windows lapse (follow-up to CAMEL-23937).
> *camel-azure-eventhubs*
> # {{EventHubsConsumer:211-236}} — unsynchronized lastTask/lastScheduledTask
> mutation races; cancelled-but-referenced task swallows checkpoint updates.
> # {{EventHubsConsumer:233}} + {{EventHubsCheckpointUpdaterTask:47}} —
> checkpoint failures logged at DEBUG only; silent unbounded replay when the
> checkpoint store breaks.
> *camel-azure-storage-queue*
> # {{QueueOperations:82-86}} — {{createQueue=true}} calls create (not
> createIfNotExists) on every send; permanent 409 when the queue was
> pre-created with metadata.
> *camel-azure-storage-blob*
> # {{BlobOperations:451-454}} — copyBlob validates the source account name
> twice, never the source container name (CAMEL-17161 copy-paste).
> # {{BlobChangeFeedOperations:46-50}} — changeFeedStartTime/EndTime ignored
> unless both are set; one bound -> whole change feed returned.
> # {{BlobCommonRequestOptions:57-60}} — ClassCastException when the documented
> BlobRequestConditions header is used with append/page blob operations
> (unchecked generic cast to SDK subtypes).
> # {{BlobOperations:157-168}} — consumer with fileDir:
> FileAlreadyExistsException on every poll after the first and
> NoSuchFileException for nested blob names (same class as the datalake
> consumer bug).
> *camel-azure-storage-datalake*
> # {{DataLakeUtils:38-47}} — appendToFile length probing calls reset() without
> mark(); breaks BufferedInputStream and rejects spooled stream caches; buffers
> whole payload in memory.
> # {{DataLakeEndpoint:45-46,94-102}} — URI option {{dataLakeServiceClient}} is
> dead (unconditionally overwritten in doStart).
> # {{DataLakeFileOperations:163-168}} — consecutive appendToFile calls compute
> the offset from the committed size only; second append overwrites the first
> (unverified against live service).
> # {{DataLakeConfiguration:105-107}} — generated catalog lists bogus operation
> enum values ("listFileSystem, listFiles"); camel-jbang validate / IDEs reject
> every real operation.
> _This issue was researched and filed by Claude Code (AI) on behalf of
> Federico Mariani (fmariani). Full findings document from the review is
> attached to the umbrella issues._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
