[jira] [Commented] (CAMEL-24117) camel-rest-openapi: one strategy instance shared by all consumers - missingOperation/mockIncludePattern cross-talk, second consumer can silently disable fail-fast validation

["Claus Ibsen (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CAMEL-24117?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18096797#comment-18096797 ] 

Claus Ibsen commented on CAMEL-24117:
-------------------------------------

Fixed via https://github.com/apache/camel/pull/24783

> camel-rest-openapi: one strategy instance shared by all consumers - missingOperation/mockIncludePattern cross-talk, second consumer can silently disable fail-fast validation
> -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24117
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24117
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-rest-openapi
>    Affects Versions: 4.21.0
>            Reporter: Federico Mariani
>            Assignee: Claus Ibsen
>            Priority: Major
>              Labels: code-review
>             Fix For: 4.22.0
>
>
> h3. Problem
> {{RestOpenApiComponent.doInit}} creates ONE {{DefaultRestOpenapiProcessorStrategy}} and {{createEndpoint}} hands the same instance to every endpoint (RestOpenApiComponent.java:181, 199-202). Each consumer's {{afterPropertiesConfigured}} then calls {{strategy.setMissingOperation(endpoint.getMissingOperation())}} and {{setMockIncludePattern(...)}} on the shared object (RestOpenApiProcessor.java:218-220) - the last consumer initialized wins for all.
> Worse: the endpoint field {{missingOperation}} defaults to {{null}} (the {{@UriParam defaultValue="fail"}} is doc-only), and the strategy's null -> fail/mock resolution in {{doInit}} (DefaultRestOpenapiProcessorStrategy.java:429-437) runs only once because {{ServiceHelper.initService}} is idempotent. With two consumers, consumer A inits -> strategy resolves {{fail}}; consumer B's {{setMissingOperation(null)}} resets it to {{null}} and {{initService}} is a no-op -> {{validateOpenApi}} matches none of the fail/ignore/mock branches: unmapped operations are silently accepted (fail-fast lost) and unmapped requests hit a consumer-less direct endpoint -> HTTP 500 at runtime. The strategy's {{uris}} list also mixes both consumers' paths, so {{doStop}} would deregister the other consumer's endpoints.
> h3. Failure scenario
> Two {{rest().openApi()}} blocks in one application - any combination of default/mock/fail -> at least one consumer runs with the wrong missingOperation mode.
> h3. Fix direction
> Create a strategy instance per endpoint (share only an explicitly user-supplied custom strategy), or move {{missingOperation}}/{{mockIncludePattern}}/{{uris}} into per-consumer state passed to the strategy methods.
> ----
> _This issue was researched and filed by Claude Code on behalf of [~croway] (GitHub: Croway), as part of a deep code review of camel-rest-openapi and camel-openapi-java on main (4.22.0-SNAPSHOT). Full findings document available on request._



--
This message was sent by Atlassian Jira
(v8.20.10#820010)