[jira] [Updated] (CAMEL-25226) camel-fory: requireClassRegistration option missing security="insecure:serialization" annotation

["Claus Ibsen (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-25226?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Claus Ibsen updated CAMEL-25226:
--------------------------------
    Fix Version/s: 4.23.0

> camel-fory: requireClassRegistration option missing security="insecure:serialization" annotation
> ------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-25226
>                 URL: https://issues.apache.org/jira/browse/CAMEL-25226
>             Project: Camel
>          Issue Type: Task
>          Components: camel-fory
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Minor
>             Fix For: 4.23.0
>
>
> The +requireClassRegistration+ option in +ForyDataFormat+ controls whether Apache Fory enforces class allowlisting during deserialization. When set to +false+, Fory will deserialize any class present in the wire payload (unsafe deserialization).
> Every other component that exposes a similar unsafe-deserialization opt-in (30+ components: camel-avro, camel-jms, camel-netty, camel-mina, etc.) carries the +@Metadata(security = "insecure:serialization")+ annotation. This annotation enables the Camel security policy framework (+camel.main.profile=prod+) to detect and reject this unsafe configuration at startup.
> The +requireClassRegistration+ field in +ForyDataFormat+ is missing this annotation. Default value is +true+ (safe), so this is an annotation/hardening gap rather than a default exposure.
> *Fix:* Add +@Metadata(label = "security", security = "insecure:serialization", insecureValue = "false")+ to the +requireClassRegistration+ field and regenerate component metadata.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)