[
https://issues.apache.org/jira/browse/CAMEL-26280?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26280 started by Claus Ibsen.
-------------------------------------------
> camel-azure-functions - validate the function app and name in invokeFunction
> ----------------------------------------------------------------------------
>
> Key: CAMEL-26280
> URL: https://issues.apache.org/jira/browse/CAMEL-26280
> Project: Camel
> Issue Type: Improvement
> Components: camel-azure
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Major
> Fix For: 4.22.3, 4.24.0
>
>
> The invokeFunction operation of the azure-functions producer builds the
> invoke URL as {{https://<functionApp>.azurewebsites.net/api/<functionName>}}
> with {{String.format}} and then calls {{FunctionsInvocationClient.invoke}}.
> Both values come from the endpoint configuration or from the
> {{CamelAzureFunctionsFunctionApp}} / {{CamelAzureFunctionsFunctionName}}
> headers, and neither is checked:
> * An empty function app is not detected and turns into
> {{https://null.azurewebsites.net/...}}, which only fails later with a
> confusing connection error.
> * A function app that is not a valid Azure app name (for example one
> containing a dot, slash, colon or at sign) is copied into the URL as is, so
> the URL no longer has the form the component documents.
> * A function name containing a query string, a fragment or dot segments
> ({{.}} / {{..}}) is copied into the path as is.
> h3. Change
> * {{FunctionsProducer.invokeFunction}}:
> ** fail fast with an {{IllegalArgumentException}} when the function app is
> missing;
> ** accept only a valid app name for the function app: letters, digits and
> hyphens, not starting or ending with a hyphen, at most 60 characters;
> ** accept the function name as a relative path under {{/api/}}: one or more
> segments separated by {{/}} (so HTTP triggers with a custom route such as
> {{products/42}} keep working), rejecting {{?}}, {{#}}, {{\}}, {{%}}, empty
> segments and {{.}} / {{..}} segments;
> ** build the URI with the multi-argument {{java.net.URI}} constructor instead
> of {{String.format}}, and check that its host is
> {{<functionApp>.azurewebsites.net}} before the invocation client is called.
> * {{FunctionsEndpoint.getServiceUrl}}: apply the same function app validation.
> * {{FunctionsInvocationClient}}: only add the function key header to https
> requests on an {{azurewebsites.net}} host.
> * Documentation: state the accepted forms of the function app and function
> name in {{azure-functions-component.adoc}} (and the regenerated catalog
> copy), and add a short note to the 4.24 upgrade guide: invokeFunction now
> rejects a function app that is not a valid app name, and a function name
> containing a query, a fragment or dot segments. Valid configurations are not
> affected.
> h3. Tests
> A new unit test class (no Azure access; a stubbed
> {{FunctionsInvocationClient}} records the URL it is given):
> * the URL is built on the app host for a plain app and function name;
> * a function app given in the header is used when it is valid;
> * a missing function app is rejected;
> * a function app with a dot, slash, colon, at sign, question mark or hash is
> rejected;
> * a function name with a query or a fragment is rejected;
> * a function name with dot segments is rejected;
> * a multi-segment route path such as {{products/42}} is accepted.
> The open CAMEL-26247 changes the same {{invokeFunction}} method; the two
> changes should be coordinated so they do not conflict.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
