You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "oscerd (via GitHub)" <gi...@apache.org> on 2026/09/03 08:08:14 UTC
[PR] CAMEL-24607: camel-langchain4j-agent-api - CodeInjectionGuardrail must count distinct injection types [camel]
oscerd opened a new pull request, #26065:
URL: https://github.com/apache/camel/pull/26065
## Issue
[CAMEL-24607](https://issues.apache.org/jira/browse/CAMEL-24607)
## Problem
In non-strict mode `CodeInjectionGuardrail.validate()` collects every matched pattern's `InjectionType`
into a `List` **without de-duplication**, then blocks the input when `detected.size() >= 2`. The inline
comment says the intent is to require "multiple **different** types", but several patterns share a type
(4 SHELL_COMMAND, 4 SQL_INJECTION, 3 JAVASCRIPT, 2 HTML_XSS, 3 TEMPLATE_INJECTION).
So a single legitimate input matching two patterns of **one** type is falsely blocked — e.g. a normal
templating question `render {{name}} and ${value}` matches both `{{...}}` and `${...}` (both
`TEMPLATE_INJECTION`) and is rejected. The sibling `PromptInjectionGuardrail` de-duplicates correctly.
## Fix
Only add a type when it is not already present, so `detected.size() >= 2` genuinely means two distinct
types matched.
## Testing
- New `testNonStrictModeDoesNotBlockMultipleMatchesOfTheSameType` asserts the templating example passes;
verified it **fails** against the unpatched code and passes with the fix. All existing
`CodeInjectionGuardrailTest` cases still pass.
- `mvn -Psourcecheck validate` green.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01Ka4dAcJMpxahMfk3kmG5Ls
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24607: camel-langchain4j-agent-api - CodeInjectionGuardrail must count distinct injection types [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #26065:
URL: https://github.com/apache/camel/pull/26065#issuecomment-5522757090
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24607: camel-langchain4j-agent-api - CodeInjectionGuardrail must count distinct injection types [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #26065:
URL: https://github.com/apache/camel/pull/26065#issuecomment-5523033440
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `components/camel-ai/camel-langchain4j-agent-api`
---
<details><summary>:microscope: Scalpel shadow comparison — Scalpel: 10 tested, 27 compile-only — current: 10 all tested</summary>
[Maveniverse Scalpel](https://github.com/maveniverse/scalpel) detected **37 affected modules** (current approach: 10).
<details><summary>:warning: Modules only in Scalpel (27)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-catalog`
- `camel-catalog-console`
- `camel-catalog-maven`
- `camel-catalog-suggest`
- `camel-componentdsl`
- `camel-endpointdsl`
- `camel-endpointdsl-support`
- `camel-itest`
- `camel-jbang-core`
- `camel-jbang-it`
- `camel-jbang-main`
- `camel-jbang-plugin-edit`
- `camel-jbang-plugin-generate`
- `camel-jbang-plugin-kubernetes`
- `camel-jbang-plugin-test`
- `camel-kamelet-main`
- `camel-launcher`
- `camel-report-maven-plugin`
- `camel-route-parser`
- `camel-yaml-dsl`
- `camel-yaml-dsl-deserializers`
- `camel-yaml-dsl-maven-plugin`
- `coverage`
- `docs`
- `dummy-component`
</details>
**Skip-tests mode would test 10 modules** (1 direct + 9 downstream), **skip tests for 27** (generated code, meta-modules)
<details><summary>Modules Scalpel would test (10)</summary>
- `camel-jbang-mcp`
- `camel-jbang-plugin-mcp`
- `camel-jbang-plugin-route-parser`
- `camel-jbang-plugin-tui`
- `camel-jbang-plugin-validate`
- `camel-langchain4j-agent`
- `camel-langchain4j-agent-api`
- `camel-launcher-container`
- `camel-yaml-dsl-validator`
- `camel-yaml-dsl-validator-maven-plugin`
</details>
<details><summary>Modules with tests skipped (27)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-catalog`
- `camel-catalog-console`
- `camel-catalog-maven`
- `camel-catalog-suggest`
- `camel-componentdsl`
- `camel-endpointdsl`
- `camel-endpointdsl-support`
- `camel-itest`
- `camel-jbang-core`
- `camel-jbang-it`
- `camel-jbang-main`
- `camel-jbang-plugin-edit`
- `camel-jbang-plugin-generate`
- `camel-jbang-plugin-kubernetes`
- `camel-jbang-plugin-test`
- `camel-kamelet-main`
- `camel-launcher`
- `camel-report-maven-plugin`
- `camel-route-parser`
- `camel-yaml-dsl`
- `camel-yaml-dsl-deserializers`
- `camel-yaml-dsl-maven-plugin`
- `coverage`
- `docs`
- `dummy-component`
</details>
> :information_source: Shadow mode — Scalpel observes but does not affect test execution. [Learn more](https://github.com/maveniverse/scalpel)
</details>
<details><summary>All tested modules (37 modules)</summary>
- Camel :: AI :: LangChain4j :: Agent
- Camel :: AI :: LangChain4j :: Agent :: API
- Camel :: All Components Sync point
- Camel :: Assembly
- Camel :: Catalog :: Camel Catalog
- Camel :: Catalog :: Camel Report Maven Plugin
- Camel :: Catalog :: Camel Route Parser
- Camel :: Catalog :: Console
- Camel :: Catalog :: Dummy Component
- Camel :: Catalog :: Maven
- Camel :: Catalog :: Suggest
- Camel :: Component DSL
- Camel :: Coverage
- Camel :: Docs
- Camel :: Endpoint DSL
- Camel :: Endpoint DSL :: Support
- Camel :: Integration Tests
- Camel :: JBang :: Core
- Camel :: JBang :: Integration tests
- Camel :: JBang :: MCP
- Camel :: JBang :: Main
- Camel :: JBang :: Plugin :: Edit
- Camel :: JBang :: Plugin :: Generate
- Camel :: JBang :: Plugin :: Kubernetes
- Camel :: JBang :: Plugin :: MCP
- Camel :: JBang :: Plugin :: Route Parser
- Camel :: JBang :: Plugin :: TUI
- Camel :: JBang :: Plugin :: Testing
- Camel :: JBang :: Plugin :: Validate
- Camel :: Kamelet Main
- Camel :: Launcher
- Camel :: Launcher :: Container
- Camel :: YAML DSL
- Camel :: YAML DSL :: Deserializers
- Camel :: YAML DSL :: Maven Plugins
- Camel :: YAML DSL :: Validator
- Camel :: YAML DSL :: Validator Maven Plugin
</details>
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/33731721980)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24607: camel-langchain4j-agent-api - CodeInjectionGuardrail must count distinct injection types [camel]
Posted by "Croway (via GitHub)" <gi...@apache.org>.
Croway merged PR #26065:
URL: https://github.com/apache/camel/pull/26065
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org