[PR] [backport camel-4.18.x] CAMEL-24676: camel-jgroups - add a configurable deserialization filter and document serialization hardening [camel]

["davsclaus (via GitHub)" <gi...@apache.org>]

davsclaus opened a new pull request, #26283:
URL: https://github.com/apache/camel/pull/26283

   ## Backport of #26267 to `camel-4.18.x`
   
   Ports the camel-jgroups deserialization filter (#26267 / CAMEL-24676) to `camel-4.18.x`.
   
   **Original PR:** #26267 - CAMEL-24676: camel-jgroups - add a configurable deserialization filter and document serialization hardening
   **Original author:** @oscerd
   **Target branch:** `camel-4.18.x`
   **Companion backport:** #26281 (`camel-4.22.x`)
   
   > ⚠️ **This is not a straight cherry-pick and it needs a normal review.** The backport
   > review exemption does not apply — `camel-4.18.x` has diverged enough that parts had to be
   > rewritten. The deviations are listed below.
   
   ### Why it could not be cherry-picked
   
   `core/camel-support` has **no `DeserializationFilterHelper`** on this branch — the shared helper
   landed in 4.22. A plain cherry-pick fails to compile:
   
   ```
   JGroupsEndpoint.java:[33,32] cannot find symbol
     symbol: class DeserializationFilterHelper
   ```
   
   ### Adaptations
   
   1. **Filter logic implemented component-locally.** The default pattern constant, the filter
      resolution and the class-only `FilterInfo` now live in `JGroupsEndpoint`, in the same
      component-local style `JmsBinding`, `MinaConverter` and `NettyHttpHelper` already use on this
      branch. The default pattern is byte-identical to the shared helper's
      `DEFAULT_CLASS_DESERIALIZATION_FILTER`
      (`!java.net.**;java.**;javax.**;org.apache.camel.**;!*`) — that is, deliberately without the
      JEP-290 graph-shape limits, which cannot be enforced once a third-party library has already
      deserialized the payload.
   2. **Tests use `org.apache.camel.test.junit5.CamelTestSupport`.** The junit6 base class used on
      `main` does not exist here.
   3. **Upgrade guide entry targets `camel-4x-upgrade-guide-4_18.adoc`**, section
      `Upgrading from 4.18.4 to 4.18.5`, and names the default pattern directly instead of referring
      to `DeserializationFilterHelper`.
   4. **Catalog docs copy dropped.** `catalog/camel-catalog` does not mirror component `.adoc` docs on
      this branch; the component's own `src/main/docs/jgroups-component.adoc` carries the new Security
      section.
   
   Everything else — `CamelJGroupsReceiver`, `JGroupsComponent`, `JGroupsException`, the option
   metadata and all generated files — is the original change.
   
   ### Verification on this branch
   
   - `mvn install -DskipTests` in `components/camel-jgroups` — success
   - `mvn test` in `components/camel-jgroups` — **22 tests, 0 failures**, including the 4 new filter tests
   - `mvn formatter:format impsort:sort` — no changes beyond the intended edits
   - No uncommitted generated-file drift after the build
   
   `JGroupsDefaultDeserializationFilterTest` passing is the useful signal here: it exercises the
   default allow-list end to end, so the component-local implementation is behaviourally equivalent to
   the shared helper it replaces.
   
   ### Note on behaviour
   
   This tightens a default on a maintenance line: the jgroups consumer now applies a deserialization
   allow-list where previously it applied none. `deserializationFilter=*` restores the previous
   behaviour, and the upgrade-guide entry documents it.
   
   ---
   
   _Claude Code on behalf of @davsclaus_
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [backport camel-4.18.x] CAMEL-24676: camel-jgroups - add a configurable deserialization filter and document serialization hardening [camel]

["davsclaus (via GitHub)" <gi...@apache.org>]

davsclaus merged PR #26283:
URL: https://github.com/apache/camel/pull/26283


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org