[
https://issues.apache.org/jira/browse/CAMEL-26311?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26311 started by shashank.
----------------------------------------
> camel-core-languages - Simple: a predicate inside ${ } with equals, !equals,
> !startsWith or !endsWith, or with a quoted argument on the left, is not read
> as a predicate: ${header.type equals 'gold'} never matches, ${uppercase('a')
> == 'B'} always matches
> -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26311
> URL: https://issues.apache.org/jira/browse/CAMEL-26311
> Project: Camel
> Issue Type: Bug
> Components: camel-core
> Reporter: shashank
> Assignee: shashank
> Priority: Major
>
> Since CAMEL-24921 (4.23.0) the braces may hold a predicate: {{${header.n >
> 0}}} is read as {{${header.n} > 0}}. {{SimpleSyntaxHints.operatorsOutside}}
> decides whether the text inside the braces is a predicate; when it answers
> null the text is read as one function (main aa63c0a4cb94, also 4.23.0). It
> answers null in two cases where the text is a predicate:
> # The operators {{equals}}, {{!equals}} (CAMEL-24582), {{!startsWith}} and
> {{!endsWith}} (CAMEL-22868) are not in its list of operator words ({{equals}}
> and {{!equals}} are also missing from the list {{wrapComparison}} uses). The
> text is then one header name:
> {code}
> ${header.type equals 'gold'} -> null as an expression; a predicate that
> never matches (header type = gold)
> ${header.type !equals 'silver'} -> never matches
> ${header.type !startsWith 'si'} -> never matches
> ${header.type} equals 'gold' -> true (outside the braces: right)
> {code}
> # A quote anywhere before the operator makes it give up
> ({{head.contains("'")}}), so a function with a quoted argument on the left
> loses the comparison: the function is created from {{uppercase('a')}} and the
> rest, {{ == 'B'}}, is ignored:
> {code}
> ${uppercase('a') == 'B'} -> A as an expression; a
> predicate that always matches
> ${substringAfter('Hello ') == 'Camel'} -> matches for any body with text
> after "Hello "
> ${uppercase(a) == 'B'} -> false (no quote: right)
> ${header.x == 'y' && uppercase('a') == 'B'} -> false (after && the comparison
> is read: right)
> {code}
> The operator page says "An operator can be written inside ${ } or outside it
> [...] Both mean the same thing" and lists these operators. In a {{filter}} or
> {{choice}} the predicate is silently always false or always true: no error,
> wrong routing.
> *Fix* (proposed): add the four operators to both lists, and take the first
> operator that is outside quotes, brackets and parentheses (the
> {{indexOutsideQuotes}} helper of CAMEL-25954) instead of giving up when a
> quote comes before it; the count of brackets and parentheses before the
> operator is then not needed (it also counted those inside quotes, as in
> {{${replace('(', '[') == 'Hi'}}}). An operator inside a quoted argument, as
> in {{${replace(' == ','=')}}}, is still part of the argument, and
> {{${properties:msg:a == b}}}, {{${header[order in progress]}}} are unchanged.
> The condition of a ternary inside the braces is wrapped with the same
> operator list, so {{${header.type equals 'gold' ? 'a' : 'b'}}}, refused
> today, works too. The fix relies on CAMEL-25954 (on main): only since then
> does {{indexOutsideQuotes}} skip brackets and parentheses.
> *Tests*: {{SimplePredicateInBracesTest}}:
> {{testEveryComparisonOperatorInsideTheBraces}},
> {{testFunctionWithAQuotedArgumentOnTheLeft}} and
> {{testEqualsInTheConditionOfATernaryInsideTheBraces}} fail on main and pass
> with the fix; {{testAnOperatorInsideQuotesIsPartOfTheArgument}} is a control.
> The language tests of camel-core and the whole camel-core suite pass with the
> fix. Every {{${ }}} text in apache/camel and camel-kamelets 4.23.0 (3 763
> distinct) gets the same answer from {{operatorsOutside}} with and without the
> fix.
> *How it was found*: a readable semantics of Simple written from the
> documentation (Rocq), extracted to an oracle and compared with the language
> on about 4.9 million generated programs; this class gave 24 800 of the
> disagreements. The decision of {{operatorsOutside}} is also checked on the
> real class files of main and of the fix in a JVM model in Rocq
> (kernel-checked).
> *Affected*: main, 4.23.x (CAMEL-24921; a backport there needs CAMEL-25954
> too).
> _Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
