You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "gnodet (via GitHub)" <gi...@apache.org> on 2026/04/27 08:27:25 UTC

[PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

gnodet opened a new pull request, #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583

   ## Summary
   
   - Adds `integration-tests/security-policy` module to test Camel's security policy enforcement framework (CAMEL-23250) in Quarkus
   - Uses process executor pattern (like `main-unknown-args-fail`) to verify startup behavior under different security policies
   - Registers the module in `integration-tests/pom.xml` and `test-categories.yaml` (group-10)
   
   ## Test cases
   
   1. **testWarnPolicyAllowsStartup** — default warn policy logs warnings but allows startup
   2. **testFailPolicyCausesStartupFailure** — fail policy blocks startup on security violations
   3. **testCategoryOverrideAllowsStartup** — category-level override (insecure-dev-policy=allow) bypasses global fail
   4. **testAllowedPropertiesExclusion** — allowed-properties list excludes specific properties from enforcement
   5. **testAllowPolicyNoWarnings** — allow policy suppresses all warnings
   
   ## Prerequisites
   
   Requires Camel 4.21.0+ which includes the security policy framework and the fix from https://github.com/apache/camel/pull/22779 (enforcement running on empty properties map).
   
   ## Test plan
   
   - [x] All 5 tests pass in JVM mode
   - [ ] CI verification
   
   _Claude Code on behalf of Guillaume Nodet_
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

Posted by "jamesnetherton (via GitHub)" <gi...@apache.org>.
jamesnetherton commented on PR #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583#issuecomment-4325435037

   >Uses process executor pattern (like main-unknown-args-fail) to verify startup behavior under different security policies
   
   We don't need to start a secondary process with `QuarkusProcessExecutor` just to pass custom configuration options. We can use `QuarkusTestProfile` to achieve the same thing.
   
   I think it might be better (assuming it works ok) to create these tests in `integration-test-groups/foundation/security-policy`. That way we don't need to add yet another module under `integration-tests`.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

Posted by "apupier (via GitHub)" <gi...@apache.org>.
apupier commented on code in PR #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583#discussion_r3153551851


##########
integration-test-groups/foundation/security-policy/src/main/java/org/apache/camel/quarkus/security/policy/SecurityPolicyResource.java:
##########
@@ -0,0 +1,90 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.quarkus.security.policy;
+
+import java.util.stream.Collectors;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import org.apache.camel.CamelContext;
+import org.apache.camel.main.SecurityPolicyResult;
+
+@Path("/security-policy")
+@ApplicationScoped
+public class SecurityPolicyResource {
+
+    @Inject
+    CamelContext camelContext;
+
+    @GET
+    @Path("/has-violations")
+    @Produces(MediaType.TEXT_PLAIN)
+    public String hasViolations() {
+        SecurityPolicyResult result = camelContext.getCamelContextExtension()
+                .getContextPlugin(SecurityPolicyResult.class);
+        if (result == null) {
+            return "null";

Review Comment:
   a bit weird to return null instead of empty string like the other methods but not a real issue



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

Posted by "jamesnetherton (via GitHub)" <gi...@apache.org>.
jamesnetherton commented on PR #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583#issuecomment-4336460736

   I'll merge this. The Milvus fix from #8593 will get automatically rebased to `camel-main` by the nightly workflow if the build is green.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

Posted by "jamesnetherton (via GitHub)" <gi...@apache.org>.
jamesnetherton commented on PR #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583#issuecomment-4327944795

   Every test class will need a corresponding IT class annotated with `QuarkusIntegrationTest`. Constructs like `@Inject` wont work in ITs, so the tests will need to be adjusted to get any required data for assertions, from the application under test via JAX-RS endpoints etc.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

Posted by "apupier (via GitHub)" <gi...@apache.org>.
apupier commented on code in PR #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583#discussion_r3147303895


##########
.github/workflows/quarkus-lts-ci-build.yaml:
##########


Review Comment:
   this change is unrelated to the PR



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583#issuecomment-4329914334

   @jamesnetherton @apupier feedback addressed


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

Posted by "jamesnetherton (via GitHub)" <gi...@apache.org>.
jamesnetherton merged PR #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

Posted by "apupier (via GitHub)" <gi...@apache.org>.
apupier commented on code in PR #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583#discussion_r3152270684


##########
integration-test-groups/foundation/security-policy/src/test/java/org/apache/camel/quarkus/security/policy/SecurityPolicyWarnTest.java:
##########
@@ -0,0 +1,36 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.quarkus.security.policy;
+
+import io.quarkus.test.junit.QuarkusTest;
+import io.restassured.RestAssured;
+import org.junit.jupiter.api.Test;
+
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.is;
+
+@QuarkusTest
+class SecurityPolicyWarnTest {
+
+    @Test
+    void warnPolicyDetectsViolations() {
+        RestAssured.when().get("/security-policy/has-violations").then().body(is("true"));
+        RestAssured.when().get("/security-policy/violation-categories").then().body(containsString("insecure:dev"));
+        RestAssured.when().get("/security-policy/violation-property-keys").then().body(containsString("devConsoleEnabled"));
+        RestAssured.when().get("/security-policy/violation-policies").then().body(containsString("warn"));
+    }

Review Comment:
   I think it will be worthy to split with several different test methods, so that each of them will report a result in case of failure.



##########
AGENTS.md:
##########
@@ -196,6 +196,12 @@ class KafkaIT extends KafkaTest {
 }
 ```
 
+### Important Constraints
+
+- **No `@Inject` in `@QuarkusIntegrationTest`**: Integration tests run the application as a separate process, so CDI injection does not work. Expose application state via JAX-RS endpoints (using `quarkus-resteasy`) and assert via RestAssured in tests. See `integration-test-groups/foundation/core/` for the pattern.
+- **Every `@QuarkusTest` needs an IT class**: Each `@QuarkusTest` class must have a corresponding `@QuarkusIntegrationTest` class that extends it, to ensure tests also run in native mode.
+- **Grouped test modules share one native application**: Modules under `integration-test-groups/` are compiled into a single grouped native binary per group. Properties in one module's `application.properties` affect ALL modules in the group. Avoid setting properties that alter global Camel behavior (e.g. `camel.main.duration-max-messages`).
+

Review Comment:
   this is unrelated to the PR and commit message.
   
   this should be provided in a different PR and can be provided directly on main branch. it will ease the maintenance of the camel-main branch



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

Posted by "apupier (via GitHub)" <gi...@apache.org>.
apupier commented on PR #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583#issuecomment-4333147965

   current failure are also happening on camel-main branch https://github.com/apache/camel-quarkus/actions/runs/25027412512/job/73304129024


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

Posted by "apupier (via GitHub)" <gi...@apache.org>.
apupier commented on PR #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583#issuecomment-4327008764

   I updated (force-push) the `camel-main` branch to have it based on the 4.21.0-SNAPSHOT.
   Please rebase on top of it. it will simplify the review and also avoid mixing unrelated commits in this PR


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583#discussion_r3152517674


##########
AGENTS.md:
##########
@@ -196,6 +196,12 @@ class KafkaIT extends KafkaTest {
 }
 ```
 
+### Important Constraints
+
+- **No `@Inject` in `@QuarkusIntegrationTest`**: Integration tests run the application as a separate process, so CDI injection does not work. Expose application state via JAX-RS endpoints (using `quarkus-resteasy`) and assert via RestAssured in tests. See `integration-test-groups/foundation/core/` for the pattern.
+- **Every `@QuarkusTest` needs an IT class**: Each `@QuarkusTest` class must have a corresponding `@QuarkusIntegrationTest` class that extends it, to ensure tests also run in native mode.
+- **Grouped test modules share one native application**: Modules under `integration-test-groups/` are compiled into a single grouped native binary per group. Properties in one module's `application.properties` affect ALL modules in the group. Avoid setting properties that alter global Camel behavior (e.g. `camel.main.duration-max-messages`).
+

Review Comment:
   _Claude Code on behalf of Guillaume Nodet_
   
   Good point. Reverted from this PR and created a separate PR targeting main: #8588



##########
integration-test-groups/foundation/security-policy/src/test/java/org/apache/camel/quarkus/security/policy/SecurityPolicyWarnTest.java:
##########
@@ -0,0 +1,36 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.quarkus.security.policy;
+
+import io.quarkus.test.junit.QuarkusTest;
+import io.restassured.RestAssured;
+import org.junit.jupiter.api.Test;
+
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.is;
+
+@QuarkusTest
+class SecurityPolicyWarnTest {
+
+    @Test
+    void warnPolicyDetectsViolations() {
+        RestAssured.when().get("/security-policy/has-violations").then().body(is("true"));
+        RestAssured.when().get("/security-policy/violation-categories").then().body(containsString("insecure:dev"));
+        RestAssured.when().get("/security-policy/violation-property-keys").then().body(containsString("devConsoleEnabled"));
+        RestAssured.when().get("/security-policy/violation-policies").then().body(containsString("warn"));
+    }

Review Comment:
   _Claude Code on behalf of Guillaume Nodet_
   
   Done — split into 4 separate test methods: `warnPolicyDetectsViolations`, `warnPolicyReportsInsecureDevCategory`, `warnPolicyReportsDevConsoleEnabledProperty`, `warnPolicyReportsWarnLevel`.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583#issuecomment-4334269037

   _Claude Code on behalf of Guillaume Nodet_
   
   The 3 CI failures are all unrelated to this PR — they share the same root cause:
   
   ```
   ClassNotFoundException: org.jboss.marshalling.ByteInput
   ```
   
   All 3 fail in `camel-quarkus-integration-test-milvus` during Quarkus class transformation (`ClassTransformingBuildStep`). The security-policy module (in group-03/foundation) is not affected.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

Posted by "apupier (via GitHub)" <gi...@apache.org>.
apupier commented on PR #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583#issuecomment-4334614443

   > The 3 CI failures all share the same root cause:
   > 
   > ```
   > ClassNotFoundException: org.jboss.marshalling.ByteInput
   > ```
   > 
   > All 3 fail in `camel-quarkus-integration-test-milvus` during Quarkus class transformation (`ClassTransformingBuildStep`). The security-policy module (in group-03/foundation) is not affected.
   > 
   > Same [`issues`](https://github.com/apache/camel-quarkus/actions/runs/24995019250) on `camel-main` branch
   > 
   > @apupier @jamesnetherton that looks unrelated to this PR, do you confirm?
   
   yes I confirmed https://github.com/apache/camel-quarkus/pull/8583#issuecomment-4333147965


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add security-policy integration test for CAMEL-23250 [camel-quarkus]

Posted by "jamesnetherton (via GitHub)" <gi...@apache.org>.
jamesnetherton commented on PR #8583:
URL: https://github.com/apache/camel-quarkus/pull/8583#issuecomment-4332803868

   Changes look ok to me. Might be best to get this merged ASAP before `camel-main` branch starts to drift into failure due to changes in the Camel core.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org