[jira] [Resolved] (CAMEL-11928) Isolation for unmarshallers

["Claus Ibsen (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-11928?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Claus Ibsen resolved CAMEL-11928.
---------------------------------
    Resolution: Abandoned

> Isolation for unmarshallers
> ---------------------------
>
>                 Key: CAMEL-11928
>                 URL: https://issues.apache.org/jira/browse/CAMEL-11928
>             Project: Camel
>          Issue Type: New Feature
>          Components: camel-core
>            Reporter: Zoran Regvart
>            Assignee: Zoran Regvart
>            Priority: Major
>             Fix For: Future
>
>
> I propose that we try to experiment isolating points of interaction with externally specified data in the unmarshallers with the purpose of not allowing data passed in the marshaller to trigger code execution or similar security issue.
> This could be a per Camel context property that we could add or a per route or unmarshaller setting that can be set. Along with this property another property white listing the allowed classes/packages to be loaded by the unmarshaller would be required.
> I think this can be accomplished by loading and running the unmarshaller within a ClassLoader that consults this whitelist, but also whitelists classes and dependencies of the unmarshaller.
> This is of course an experiment, and it could be well proven that such an implementation would be too complex or much to difficult to use. I would not like to duplicate any effort done by Java modules, OSGI or any other module system.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)