fix(DPE-3961): backport from 4.14 - #163
Merged
Merged
Conversation
apache#22639) * CAMEL-23321: JMS deserializationFilter should be global configurable on component level. Fix test in itest.
…e by default (apache#22920) * CAMEL-23373: camel-jms - Disable ObjectMessage by default (apache#22866) * CAMEL-23373: camel-jms - Disable ObjectMessage by default Java object serialization over JMS is rarely used in practice and is a recurring source of security advisories. Disable creation and reading of jakarta.jms.ObjectMessage by default and add a new objectMessageEnabled option (default false) on JmsConfiguration / JmsComponent / JmsEndpoint to opt back in. When disabled, JmsBinding now refuses to: - create an ObjectMessage from a Serializable body (auto-detected jmsMessageType=Object or explicitly set) - create an ObjectMessage for transferExchange or transferException - extract the body of a received ObjectMessage Existing tests that rely on ObjectMessage have been updated to opt in. A new JmsObjectMessageEnabledTest validates the default disabled behavior on producer and consumer side, and JmsBindingTest covers the unit-level checks. Documentation updated in the 4.21 upgrade guide. Signed-off-by: Andrea Cosentino <ancosen@gmail.com> * CAMEL-23373: Regenerate camel-jms / camel-activemq* / camel-amqp DSL builders The componentdsl and endpointdsl builder factories for camel-jms and the JMS-derived components (camel-activemq, camel-activemq6, camel-amqp) needed to be regenerated to expose the new objectMessageEnabled option in the fluent DSL. These are generated files only; no hand-written code changed. Signed-off-by: Andrea Cosentino <ancosen@gmail.com> --------- Signed-off-by: Andrea Cosentino <ancosen@gmail.com> * CAMEL-23373: camel-jms - Disable ObjectMessage by default --------- Signed-off-by: Andrea Cosentino <ancosen@gmail.com> Co-authored-by: Claus Ibsen <claus.ibsen@gmail.com>
) For consistency with camel-jms (CAMEL-23373), disable creation and reading of jakarta.jms.ObjectMessage by default in camel-sjms and add a new objectMessageEnabled option (default false) on SjmsComponent and SjmsEndpoint to opt back in. camel-sjms2 inherits the change via Sjms2Endpoint extends SjmsEndpoint and Sjms2Component extends SjmsComponent. When disabled, JmsBinding refuses to: - create an ObjectMessage from a Serializable body (auto-detected jmsMessageType=Object or explicitly set) - create an ObjectMessage for transferException - extract the body of a received ObjectMessage Both component- and endpoint-level options carry security="insecure:serialization" so the Camel security policy sees a uniform signal at both levels. Tests: SjmsObjectMessageEnabledTest covers producer/consumer default-disabled behavior, endpoint-level override, and component-level override; JmsBindingObjectMessageEnabledTest covers the transferException reply path. Documentation updated in the 4.21 upgrade guide. Closes apache#22945 Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
…r JMS ObjectMessage handling in camel-jms and camel-sjms (apache#22604) * CAMEL-23321: Add deserialization filtering for JMS ObjectMessage handling in camel-jms and camel-sjms Aligns the JMS component family with the defense-in-depth pattern applied in camel-netty (CAMEL-23297) and camel-mina (CAMEL-23319). JmsBinding (camel-jms and camel-sjms) now resolves a deserialization filter at construction using the same priority as the other components: configured value -> JVM -Djdk.serialFilter -> default "java.**;javax.**;org.apache.camel.**;!*". After ObjectMessage.getObject(), the class of the returned payload is checked against the filter and a SecurityException is thrown on reject. The filter is exposed as a new endpoint option 'deserializationFilter' on JmsConfiguration (camel-jms) and SjmsEndpoint (camel-sjms). Note: this check runs after the JMS provider has deserialized the payload, so the option does not, on its own, stop gadget chains that execute inside the provider's ObjectInputStream. The javadoc makes this explicit and points users to JVM-wide -Djdk.serialFilter and provider-specific filters for complete coverage. camel-amqp inherits the behaviour via AMQPJmsBinding. Signed-off-by: Andrea Cosentino <ancosen@gmail.com> * Regen Signed-off-by: Andrea Cosentino <ancosen@gmail.com> * Regen Signed-off-by: Andrea Cosentino <ancosen@gmail.com> * CAMEL-23321: Add deserialization filtering for JMS ObjectMessage handling in camel-jms and camel-sjms Configure deserializationFilter in CxfToJmsInOutTest and JmsToCxfInOutTest Spring contexts to allow org.apache.cxf.** classes alongside the defaults, so MessageContentsList payloads exchanged over JMS ObjectMessage pass the filter introduced in CAMEL-23321. Signed-off-by: Andrea Cosentino <ancosen@gmail.com> * Regen Signed-off-by: Andrea Cosentino <ancosen@gmail.com> --------- Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
CAMEL-23373 commit 75d7991
CAMEL-23409. commit 17f8fcb
CAMEL-23321. commit 1816ae 6a82709
Target
mainbranch)Tracking
Apache Camel coding standards and style
mvn clean install -DskipTestslocally from root folder and I have committed all auto-generated changes.AI-assisted contributions
Co-authored-bytrailers) and the PR description identifies the AI tool used.