[jira] [Updated] (CAMEL-24756) camel-base-engine - http: resources are resolved with no connect or read timeout

["Claus Ibsen (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24756?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Claus Ibsen updated CAMEL-24756:
--------------------------------
    Component/s: camel-core

> camel-base-engine - http: resources are resolved with no connect or read timeout
> --------------------------------------------------------------------------------
>
>                 Key: CAMEL-24756
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24756
>             Project: Camel
>          Issue Type: Improvement
>          Components: camel-core
>            Reporter: Andrea Cosentino
>            Priority: Minor
>
> h2. Problem
> {{DefaultResourceResolvers.HttpResource}} opens an {{http:}} resource with no timeouts at all:
> {code:java}
> @Override
> public InputStream getInputStream() throws IOException {
>     URLConnection con = URI.create(getLocation()).toURL().openConnection();
>     con.setUseCaches(false);
>     try {
>         setContentType(con.getContentType());
>         return con.getInputStream();
>     ...
> {code}
> {{exists()}} does the same. Neither calls {{setConnectTimeout}} or {{setReadTimeout}}, and the JDK default for both is {{0}} - wait indefinitely.
> Every component that resolves a resource through {{ResourceHelper}} with an {{http:}} location inherits this: camel-groovy, camel-velocity, camel-xslt, camel-opa's {{policyBundle}}, and the rest.
> h2. Why it matters
> Resource resolution usually happens in {{doStart()}}, which runs on the bootstrap thread. A slow or black-holed HTTP server therefore does not fail the one route - it stalls {{CamelContext}} startup, with no log line saying what it is waiting for and no way to bound it short of killing the process.
> A refused connection fails fast, so this only shows up against a host that accepts and then does not answer - which is exactly the case an operator cannot reproduce locally.
> h2. Proposal
> Set a connect and read timeout on the {{URLConnection}} in both {{getInputStream()}} and {{exists()}}, with a sensible default (30s is the convention elsewhere in Camel) and a way to override it - a property on the resource loader, or {{camel.main.*}} configuration, so a deployment fetching a large artifact over a slow link can raise it.
> Care is needed not to break the streaming contract: {{getInputStream()}} returns the stream to the caller, so a read timeout applies to the whole read, not just the handshake.
> h2. Scope
> {{camel-base-engine}}. Behaviour change from "wait forever" to "fail after N seconds", so it wants an upgrade-guide entry.
> Raised by the review bot on https://github.com/apache/camel/pull/26445, where {{camel-opa}}'s {{policyBundle}} can be an {{http:}} location; documented there as a caveat, but the fix belongs here.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)