[PR] [backport camel-4.14.x] CAMEL-23321: Add deserialization filtering for JMS ObjectMessage handling in camel-jms and camel-sjms [camel]

["oscerd (via GitHub)" <gi...@apache.org>]

oscerd opened a new pull request, #22604:
URL: https://github.com/apache/camel/pull/22604

   ## Backport of #22598
   
   Cherry-pick of #22598 onto `camel-4.14.x`.
   
   **Original PR:** #22598 - CAMEL-23321: Add deserialization filtering for JMS ObjectMessage handling in camel-jms and camel-sjms
   **Original author:** @oscerd
   **Target branch:** `camel-4.14.x`
   **Jira:** https://issues.apache.org/jira/browse/CAMEL-23321
   
   Two commits on this branch:
   1. `CAMEL-23321: Add deserialization filtering for JMS ObjectMessage handling in camel-jms and camel-sjms` (cherry-picked from `c5c8d4f668c`, one conflict resolved — see below)
   2. `Regen` — regenerated `camel-jms` catalog on the `camel-4.14.x` baseline
   
   ### Conflict resolution
   
   Cherry-picking `c5c8d4f668c` produced three conflicts:
   
   1. `components/camel-sjms/src/main/java/org/apache/camel/component/sjms/jms/JmsBinding.java` — style-only: `main` uses pattern-matching `instanceof`, `camel-4.14.x` uses explicit cast. Resolved by keeping the 4.14.x style and adding only the security-relevant `checkDeserializedClass(payload)` call and `// NOSONAR` marker:
   
      ```java
      Object payload = objectMessage.getObject();
      checkDeserializedClass(payload);
      if (payload instanceof DefaultExchangeHolder) {
          DefaultExchangeHolder holder = (DefaultExchangeHolder) payload;
          DefaultExchangeHolder.unmarshal(exchange, holder); // NOSONAR
          return exchange.getIn().getBody();
      }
      ```
   
   2. `components/camel-jms/src/generated/java/org/apache/camel/component/jms/JmsEndpointUriFactory.java`
   3. `components/camel-jms/src/generated/resources/META-INF/org/apache/camel/component/jms/jms.json`
   
      Both are generated files whose baselines diverge between 4.14.x and main (different property counts / indices). Resolved by keeping the 4.14.x baseline (`--ours`) and regenerating them locally against the 4.14.x source — the `Regen` commit on this branch contains that regeneration.
   
   ### Skipped
   
   The original `Regen` commit `e1d060f2147` from #22598 touched many downstream JMS-family catalog files (camel-activemq, camel-activemq6, camel-amqp, camel-sjms2, camel-catalog, DSL factories) whose 4.14.x content diverges from main. It was skipped in favor of the locally-regenerated `camel-jms` catalog in this PR. Other downstream catalogs on 4.14.x can be regenerated in a follow-up if/when CI flags a catalog mismatch.
   
   ### Verification
   
   - Cherry-pick applied with one manual style resolution (documented above) and `--ours` on two generated files (regenerated in a separate commit)
   - `camel-jms` and `camel-sjms` compile cleanly on the `camel-4.14.x` baseline
   - Apache CI will run the authoritative test suite and catalog consistency checks
   
   _Claude Code on behalf of Andrea Cosentino_


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [backport camel-4.14.x] CAMEL-23321: Add deserialization filtering for JMS ObjectMessage handling in camel-jms and camel-sjms [camel]

["oscerd (via GitHub)" <gi...@apache.org>]

oscerd merged PR #22604:
URL: https://github.com/apache/camel/pull/22604


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org