[jira] [Resolved] (CAMEL-25223) camel-jgroups: fail fast (or require explicit opt-in) when the consumer has no pre-read deserialization control on the default channel

["Claus Ibsen (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-25223?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Claus Ibsen resolved CAMEL-25223.
---------------------------------
    Resolution: Fixed

Fixed via https://github.com/apache/camel/pull/27205 (merged to main for 4.23.0).

_Claude Code on behalf of davsclaus_

> camel-jgroups: fail fast (or require explicit opt-in) when the consumer has no pre-read deserialization control on the default channel
> --------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-25223
>                 URL: https://issues.apache.org/jira/browse/CAMEL-25223
>             Project: Camel
>          Issue Type: Improvement
>          Components: camel-jgroups
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.23.0
>
>
> Follow-up / hardening on top of CAMEL-24676.
> CAMEL-24676 added a {{deserializationFilter}} option and a default, post-read class check in the camel-jgroups consumer, documented as defense-in-depth. The controls that actually take effect *before* JGroups reads the object are a JVM-wide {{-Djdk.serialFilter}}, the JGroups-native {{jgroups.deserialization.filter}} system property (JGroups 5.5.x+), or a channel configured with authentication/encryption.
> With the default channel ({{new JChannel()}}, i.e. no {{channelProperties}}) and none of those configured, the consumer starts silently with no pre-read control in place and no signal to the operator.
> Proposal: on consumer start, detect whether any pre-read control is in effect - the {{deserializationFilter}} option, a JVM-wide filter ({{ObjectInputFilter.Config.getSerialFilter()}}), the {{jgroups.deserialization.filter}} property, or an authenticated/encrypted channel. When none is, either fail to start with a clear message pointing at the component Security section, or require an explicit opt-in option to keep the current permissive behaviour (mirroring how camel-jms gates object messages).
> Document the new behaviour and the {{jgroups.deserialization.filter}} property in the component Security section and the upgrade guide (changed default / new option).
> Touch points:
> - components/camel-jgroups/.../JGroupsEndpoint.java (doStart)
> - components/camel-jgroups/.../JGroupsComponent.java (new option)
> - components/camel-jgroups/src/main/docs/jgroups-component.adoc (+ matching upgrade-guide entry on main)
> Continues the serialization-hardening consistency work (CAMEL-24676; shared DeserializationFilterHelper from CAMEL-23815 / CAMEL-24296).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)