You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "oscerd (via GitHub)" <gi...@apache.org> on 2026/06/23 09:48:28 UTC
[PR] CAMEL-23769: camel-http-common - apply a configurable ObjectInputFilter when deserializing Java objects [camel]
oscerd opened a new pull request, #24196:
URL: https://github.com/apache/camel/pull/24196
Fixes [CAMEL-23769](https://issues.apache.org/jira/browse/CAMEL-23769).
## Problem
`HttpHelper.deserializeJavaObjectFromStream` read a Java-serialized object via `CamelObjectInputStream` **without an `ObjectInputFilter`**. This is only reachable behind the opt-in `allowJavaSerializedObject` / `transferException` options, but the sibling `camel-netty-http`, `camel-jms` and `camel-vertx-http` bindings already apply a filter on that path. This aligns `camel-http-common` with them (defense-in-depth).
## Change
- **`HttpHelper`** — new overload `deserializeJavaObjectFromStream(is, ctx, deserializationFilter)` that calls `ois.setObjectInputFilter(resolve(filter))` before `readObject()`; the existing 1-/2-arg methods delegate to it, so **every call site is covered** (the `DefaultHttpBinding` request side and the camel-http `HttpProducer` response side). `resolveDeserializationFilter` mirrors the siblings: configured pattern → JVM-wide `jdk.serialFilter` → conservative `DEFAULT_DESERIALIZATION_FILTER`.
- **`HttpCommonComponent`** — new `deserializationFilter` `@Metadata` option (`jdk.serialFilter` syntax).
- **`HttpBinding`** (SPI) — `get/setDeserializationFilter` added as **`default` methods** (no break for external `HttpBinding` implementations).
- Wired in `DefaultHttpBinding`, `HttpCommonEndpoint`, `JettyHttpEndpoint12`, `ServletEndpoint`, and `HttpProducer` (camel-http).
Default filter: `!java.net.**;java.**;javax.**;org.apache.camel.**;maxdepth=20;maxrefs=10000;maxbytes=10485760;!*`.
## Tests
- `HttpHelperDeserializationTest` — configured filter rejects a denied class, allows a permitted one, and the default filter denies `java.net.**`.
- Full reactor build (`mvn clean install -DskipTests`, 2365 modules) green; metadata regenerated for http/jetty/servlet/atmosphere-websocket (the new option + index shift only, verified no unrelated drift).
## Documentation
- `camel-4x-upgrade-guide-4_21.adoc` — note for the HTTP components.
## Compatibility / backport
Behaviour change: on the **opt-in** deserialization path, a payload referencing a denied class may now be rejected. This is a new option (config surface), so per project convention it likely targets **4.21.0**; final `fixVersions` is at the maintainers' discretion.
---
_Claude Code on behalf of Andrea Cosentino_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23769: camel-http-common - apply a configurable ObjectInputFilter when deserializing Java objects [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #24196:
URL: https://github.com/apache/camel/pull/24196#issuecomment-4778496510
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23769: camel-http-common - apply a configurable ObjectInputFilter when deserializing Java objects [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd merged PR #24196:
URL: https://github.com/apache/camel/pull/24196
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23769: camel-http-common - apply a configurable ObjectInputFilter when deserializing Java objects [camel]
Posted by "apupier (via GitHub)" <gi...@apache.org>.
apupier commented on PR #24196:
URL: https://github.com/apache/camel/pull/24196#issuecomment-4787308863
@oscerd conflict on upgrade guide to resolve
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23769: camel-http-common - apply a configurable ObjectInputFilter when deserializing Java objects [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #24196:
URL: https://github.com/apache/camel/pull/24196#issuecomment-4778669243
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `catalog/camel-catalog`
- `components/camel-atmosphere-websocket`
- `components/camel-http-common`
- `components/camel-http`
- `components/camel-jetty`
- `components/camel-servlet`
- `docs`
- `dsl/camel-componentdsl`
> :information_source: Dependent modules were not tested because the total number of affected modules exceeded the threshold (50). Use the `test-dependents` label to force testing all dependents.
:warning: **Some tests are disabled on GitHub Actions** (`@DisabledIfSystemProperty(named = "ci.env.name")`) and require manual verification:
- `components/camel-jetty`: 1 test(s) disabled on GitHub Actions
<details><summary>Build reactor — dependencies compiled but only changed modules were tested (8 modules)</summary>
- Camel :: Atmosphere WebSocket Servlet
- Camel :: Catalog :: Camel Catalog
- Camel :: Component DSL
- Camel :: Docs
- Camel :: HTTP
- Camel :: HTTP :: Common
- Camel :: Jetty
- Camel :: Servlet
</details>
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/28017508388)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23769: camel-http-common - apply a configurable ObjectInputFilter when deserializing Java objects [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #24196:
URL: https://github.com/apache/camel/pull/24196#discussion_r3458818938
##########
components/camel-http-common/src/main/java/org/apache/camel/http/common/HttpHelper.java:
##########
@@ -40,9 +41,23 @@
import org.apache.camel.util.IOHelper;
import org.apache.camel.util.URISupport;
import org.apache.camel.util.UnsafeUriCharactersEncoder;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
public final class HttpHelper {
+ /**
Review Comment:
This default filter includes `maxdepth=20;maxrefs=10000;maxbytes=10485760` which none of the sibling components (`camel-netty-http`, `camel-vertx-http`, `camel-jms`) include in their `DEFAULT_DESERIALIZATION_FILTER`. Their default is:
```
!java.net.**;java.**;javax.**;org.apache.camel.**;!*
```
Is this intentional? If so, it would be good to unify across all components in a follow-up. If not, dropping the graph-shape limits here would align exactly with the siblings.
_Claude Code on behalf of Guillaume Nodet_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23769: camel-http-common - apply a configurable ObjectInputFilter when deserializing Java objects [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on code in PR #24196:
URL: https://github.com/apache/camel/pull/24196#discussion_r3458871158
##########
components/camel-http-common/src/main/java/org/apache/camel/http/common/HttpHelper.java:
##########
@@ -40,9 +41,23 @@
import org.apache.camel.util.IOHelper;
import org.apache.camel.util.URISupport;
import org.apache.camel.util.UnsafeUriCharactersEncoder;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
public final class HttpHelper {
+ /**
Review Comment:
Thanks for the careful look. I double-checked the sibling defaults, and the JEP-290 graph-shape limits are in fact present in the two HTTP siblings — so this is deliberately aligned rather than divergent:
- **camel-netty-http** — `NettyHttpHelper.DEFAULT_DESERIALIZATION_FILTER` = `!java.net.**;java.**;javax.**;org.apache.camel.**;maxdepth=20;maxrefs=10000;maxbytes=10485760;!*`
- **camel-vertx-http** — `VertxHttpHelper` — identical, with the limits
- **camel-netty** — `NettyConverter` — identical, with the limits
- **camel-jms** — `JmsBinding` is the only one that omits them (`…org.apache.camel.**;!*`)
So `camel-http-common` now matches the HTTP-stream siblings (netty-http / vertx-http) exactly; the only difference is from `camel-jms`, which reads from a broker rather than a raw network socket where the graph-shape limits matter most. The inclusion here is intentional and consistent with the components that, like this one, deserialize from network streams. Happy to unify the `camel-jms` default into the same pattern in a follow-up if we'd prefer a single shared default everywhere.
_Claude Code on behalf of Andrea Cosentino_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23769: camel-http-common - apply a configurable ObjectInputFilter when deserializing Java objects [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on PR #24196:
URL: https://github.com/apache/camel/pull/24196#issuecomment-4778156233
Thanks for the review and approval, @davsclaus. On the two non-blocking suggestions:
1. **Filter caching** — `HttpHelper.resolveDeserializationFilter` is a stateless static helper shared by both the consumer (`DefaultHttpBinding`) and the producer (`HttpProducer`), so unlike `JmsBinding` there's no single binding instance to cache a `final` field on. `ObjectInputFilter.Config.createFilter(...)` only runs on the opt-in `allowJavaSerializedObject` / `transferException` path (rare), so as you noted the overhead is negligible — I've kept the helper stateless rather than thread a cached `ObjectInputFilter` through the API. Glad to revisit it together with the shared-utility refactor below.
2. **Shared utility** — agreed: `DEFAULT_DESERIALIZATION_FILTER` + `resolveDeserializationFilter()` now live in `HttpHelper`, `NettyHttpHelper` / `NettyConverter`, `VertxHttpHelper` and `JmsBinding`, and consolidating them into `camel-support` would reduce the duplication (and would be the right place to also unify the `camel-jms` default per @gnodet's comment). I'd prefer to do that as a separate follow-up rather than widen this PR's scope.
_Claude Code on behalf of Andrea Cosentino_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23769: camel-http-common - apply a configurable ObjectInputFilter when deserializing Java objects [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on PR #24196:
URL: https://github.com/apache/camel/pull/24196#issuecomment-4778299682
Follow-up for the shared-utility consolidation (and unifying the camel-jms default) tracked as **CAMEL-23815** (targeting 4.22.0). _Claude Code on behalf of Andrea Cosentino_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org