You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by da...@apache.org on 2020/05/05 16:31:20 UTC
[camel] 01/03: CAMEL-15013: Template components - Add option to
turn on|off allow using header with override template
This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/camel.git
commit af4c21ad59427cc60bad4a8bbdad62895a07654e
Author: Claus Ibsen <cl...@gmail.com>
AuthorDate: Tue May 5 18:20:20 2020 +0200
CAMEL-15013: Template components - Add option to turn on|off allow using header with override template
---
.../component/jslt/JsltComponentConfigurer.java | 5 ++++
.../component/jslt/JsltEndpointConfigurer.java | 5 ++++
.../org/apache/camel/component/jslt/jslt.json | 2 ++
.../camel-jslt/src/main/docs/jslt-component.adoc | 6 ++--
.../apache/camel/component/jslt/JsltComponent.java | 19 ++++++++++++
.../apache/camel/component/jslt/JsltEndpoint.java | 30 ++++++++++++++-----
.../apache/camel/component/jslt/JsltBasicTest.java | 2 +-
.../camel/component/jslt/JsltFunctionsTest.java | 3 ++
.../apache/camel/component/jslt/JsltQueryTest.java | 3 +-
.../component/dsl/JsltComponentBuilderFactory.java | 18 ++++++++++++
.../endpoint/dsl/JsltEndpointBuilderFactory.java | 34 ++++++++++++++++++++++
11 files changed, 114 insertions(+), 13 deletions(-)
diff --git a/components/camel-jslt/src/generated/java/org/apache/camel/component/jslt/JsltComponentConfigurer.java b/components/camel-jslt/src/generated/java/org/apache/camel/component/jslt/JsltComponentConfigurer.java
index 68e8307..05cc16a 100644
--- a/components/camel-jslt/src/generated/java/org/apache/camel/component/jslt/JsltComponentConfigurer.java
+++ b/components/camel-jslt/src/generated/java/org/apache/camel/component/jslt/JsltComponentConfigurer.java
@@ -19,6 +19,8 @@ public class JsltComponentConfigurer extends PropertyConfigurerSupport implement
public boolean configure(CamelContext camelContext, Object obj, String name, Object value, boolean ignoreCase) {
JsltComponent target = (JsltComponent) obj;
switch (ignoreCase ? name.toLowerCase() : name) {
+ case "allowtemplatefromheader":
+ case "allowTemplateFromHeader": target.setAllowTemplateFromHeader(property(camelContext, boolean.class, value)); return true;
case "basicpropertybinding":
case "basicPropertyBinding": target.setBasicPropertyBinding(property(camelContext, boolean.class, value)); return true;
case "functions": target.setFunctions(property(camelContext, java.util.Collection.class, value)); return true;
@@ -31,6 +33,7 @@ public class JsltComponentConfigurer extends PropertyConfigurerSupport implement
@Override
public Map<String, Object> getAllOptions(Object target) {
Map<String, Object> answer = new CaseInsensitiveMap();
+ answer.put("allowTemplateFromHeader", boolean.class);
answer.put("basicPropertyBinding", boolean.class);
answer.put("functions", java.util.Collection.class);
answer.put("lazyStartProducer", boolean.class);
@@ -41,6 +44,8 @@ public class JsltComponentConfigurer extends PropertyConfigurerSupport implement
public Object getOptionValue(Object obj, String name, boolean ignoreCase) {
JsltComponent target = (JsltComponent) obj;
switch (ignoreCase ? name.toLowerCase() : name) {
+ case "allowtemplatefromheader":
+ case "allowTemplateFromHeader": return target.isAllowTemplateFromHeader();
case "basicpropertybinding":
case "basicPropertyBinding": return target.isBasicPropertyBinding();
case "functions": return target.getFunctions();
diff --git a/components/camel-jslt/src/generated/java/org/apache/camel/component/jslt/JsltEndpointConfigurer.java b/components/camel-jslt/src/generated/java/org/apache/camel/component/jslt/JsltEndpointConfigurer.java
index 47efb03..d395382 100644
--- a/components/camel-jslt/src/generated/java/org/apache/camel/component/jslt/JsltEndpointConfigurer.java
+++ b/components/camel-jslt/src/generated/java/org/apache/camel/component/jslt/JsltEndpointConfigurer.java
@@ -19,6 +19,8 @@ public class JsltEndpointConfigurer extends PropertyConfigurerSupport implements
public boolean configure(CamelContext camelContext, Object obj, String name, Object value, boolean ignoreCase) {
JsltEndpoint target = (JsltEndpoint) obj;
switch (ignoreCase ? name.toLowerCase() : name) {
+ case "allowtemplatefromheader":
+ case "allowTemplateFromHeader": target.setAllowTemplateFromHeader(property(camelContext, boolean.class, value)); return true;
case "basicpropertybinding":
case "basicPropertyBinding": target.setBasicPropertyBinding(property(camelContext, boolean.class, value)); return true;
case "contentcache":
@@ -35,6 +37,7 @@ public class JsltEndpointConfigurer extends PropertyConfigurerSupport implements
@Override
public Map<String, Object> getAllOptions(Object target) {
Map<String, Object> answer = new CaseInsensitiveMap();
+ answer.put("allowTemplateFromHeader", boolean.class);
answer.put("basicPropertyBinding", boolean.class);
answer.put("contentCache", boolean.class);
answer.put("lazyStartProducer", boolean.class);
@@ -47,6 +50,8 @@ public class JsltEndpointConfigurer extends PropertyConfigurerSupport implements
public Object getOptionValue(Object obj, String name, boolean ignoreCase) {
JsltEndpoint target = (JsltEndpoint) obj;
switch (ignoreCase ? name.toLowerCase() : name) {
+ case "allowtemplatefromheader":
+ case "allowTemplateFromHeader": return target.isAllowTemplateFromHeader();
case "basicpropertybinding":
case "basicPropertyBinding": return target.isBasicPropertyBinding();
case "contentcache":
diff --git a/components/camel-jslt/src/generated/resources/org/apache/camel/component/jslt/jslt.json b/components/camel-jslt/src/generated/resources/org/apache/camel/component/jslt/jslt.json
index 0110352..bad2a74 100644
--- a/components/camel-jslt/src/generated/resources/org/apache/camel/component/jslt/jslt.json
+++ b/components/camel-jslt/src/generated/resources/org/apache/camel/component/jslt/jslt.json
@@ -21,12 +21,14 @@
"lenientProperties": false
},
"componentProperties": {
+ "allowTemplateFromHeader": { "kind": "property", "displayName": "Allow Template From Header", "group": "producer", "label": "", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "secret": false, "defaultValue": "false", "description": "Whether to allow to use resource template from header or not (default false). Enabling this allows to specify dynamic templates via message header. However this can be seen as a potential security vulnerability if the he [...]
"lazyStartProducer": { "kind": "property", "displayName": "Lazy Start Producer", "group": "producer", "label": "producer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "secret": false, "defaultValue": false, "description": "Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the r [...]
"basicPropertyBinding": { "kind": "property", "displayName": "Basic Property Binding", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "secret": false, "defaultValue": false, "description": "Whether the component should use basic property binding (Camel 2.x) or the newer property binding with additional capabilities" },
"functions": { "kind": "property", "displayName": "Functions", "group": "advanced", "label": "advanced", "required": false, "type": "array", "javaType": "java.util.Collection<com.schibsted.spt.data.jslt.Function>", "deprecated": false, "secret": false, "description": "JSLT can be extended by plugging in functions written in Java." }
},
"properties": {
"resourceUri": { "kind": "path", "displayName": "Resource Uri", "group": "producer", "label": "", "required": true, "type": "string", "javaType": "java.lang.String", "deprecated": false, "deprecationNote": "", "secret": false, "description": "Path to the resource. You can prefix with: classpath, file, http, ref, or bean. classpath, file and http loads the resource using these protocols (classpath is default). ref will lookup the resource in the registry. bean will call a method on a [...]
+ "allowTemplateFromHeader": { "kind": "parameter", "displayName": "Allow Template From Header", "group": "producer", "label": "", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "secret": false, "defaultValue": "false", "description": "Whether to allow to use resource template from header or not (default false). Enabling this allows to specify dynamic templates via message header. However this can be seen as a potential security vulnerability if the h [...]
"contentCache": { "kind": "parameter", "displayName": "Content Cache", "group": "producer", "label": "", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "secret": false, "defaultValue": "false", "description": "Sets whether to use resource content cache or not" },
"prettyPrint": { "kind": "parameter", "displayName": "Pretty Print", "group": "common", "label": "common", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "secret": false, "defaultValue": "false", "description": "If true, JSON in output message is pretty printed." },
"lazyStartProducer": { "kind": "parameter", "displayName": "Lazy Start Producer", "group": "producer", "label": "producer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "secret": false, "defaultValue": false, "description": "Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the [...]
diff --git a/components/camel-jslt/src/main/docs/jslt-component.adoc b/components/camel-jslt/src/main/docs/jslt-component.adoc
index 7ee7efa..5f3f419 100644
--- a/components/camel-jslt/src/main/docs/jslt-component.adoc
+++ b/components/camel-jslt/src/main/docs/jslt-component.adoc
@@ -50,13 +50,14 @@ format, `?option=value&option=value&...`
// component options: START
-The JSLT component supports 3 options, which are listed below.
+The JSLT component supports 4 options, which are listed below.
[width="100%",cols="2,5,^1,2",options="header"]
|===
| Name | Description | Default | Type
+| *allowTemplateFromHeader* (producer) | Whether to allow to use resource template from header or not (default false). Enabling this allows to specify dynamic templates via message header. However this can be seen as a potential security vulnerability if the header is coming from a malicious user, so use this with care. | false | boolean
| *lazyStartProducer* (producer) | Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and [...]
| *basicPropertyBinding* (advanced) | Whether the component should use basic property binding (Camel 2.x) or the newer property binding with additional capabilities | false | boolean
| *functions* (advanced) | JSLT can be extended by plugging in functions written in Java. | | Collection
@@ -87,12 +88,13 @@ with the following path and query parameters:
|===
-=== Query Parameters (5 parameters):
+=== Query Parameters (6 parameters):
[width="100%",cols="2,5,^1,2",options="header"]
|===
| Name | Description | Default | Type
+| *allowTemplateFromHeader* (producer) | Whether to allow to use resource template from header or not (default false). Enabling this allows to specify dynamic templates via message header. However this can be seen as a potential security vulnerability if the header is coming from a malicious user, so use this with care. | false | boolean
| *contentCache* (producer) | Sets whether to use resource content cache or not | false | boolean
| *prettyPrint* (common) | If true, JSON in output message is pretty printed. | false | boolean
| *lazyStartProducer* (producer) | Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and [...]
diff --git a/components/camel-jslt/src/main/java/org/apache/camel/component/jslt/JsltComponent.java b/components/camel-jslt/src/main/java/org/apache/camel/component/jslt/JsltComponent.java
index a890301..d79c8a7 100644
--- a/components/camel-jslt/src/main/java/org/apache/camel/component/jslt/JsltComponent.java
+++ b/components/camel-jslt/src/main/java/org/apache/camel/component/jslt/JsltComponent.java
@@ -31,6 +31,8 @@ public class JsltComponent extends DefaultComponent {
@Metadata(label = "advanced")
private Collection<Function> functions;
+ @Metadata(defaultValue = "false")
+ private boolean allowTemplateFromHeader;
public JsltComponent() {
}
@@ -41,6 +43,8 @@ public class JsltComponent extends DefaultComponent {
JsltEndpoint answer = new JsltEndpoint(uri, this, remaining);
answer.setContentCache(cache);
+ answer.setAllowTemplateFromHeader(allowTemplateFromHeader);
+ setProperties(answer, parameters);
// if its a http resource then append any remaining parameters and update the resource uri
if (ResourceHelper.isHttpUri(remaining)) {
@@ -61,4 +65,19 @@ public class JsltComponent extends DefaultComponent {
public void setFunctions(Collection<Function> functions) {
this.functions = functions;
}
+
+ public boolean isAllowTemplateFromHeader() {
+ return allowTemplateFromHeader;
+ }
+
+ /**
+ * Whether to allow to use resource template from header or not (default false).
+ *
+ * Enabling this allows to specify dynamic templates via message header. However this can
+ * be seen as a potential security vulnerability if the header is coming from a malicious user, so use this with care.
+ */
+ public void setAllowTemplateFromHeader(boolean allowTemplateFromHeader) {
+ this.allowTemplateFromHeader = allowTemplateFromHeader;
+ }
+
}
diff --git a/components/camel-jslt/src/main/java/org/apache/camel/component/jslt/JsltEndpoint.java b/components/camel-jslt/src/main/java/org/apache/camel/component/jslt/JsltEndpoint.java
index ce323c2..5f97da8 100644
--- a/components/camel-jslt/src/main/java/org/apache/camel/component/jslt/JsltEndpoint.java
+++ b/components/camel-jslt/src/main/java/org/apache/camel/component/jslt/JsltEndpoint.java
@@ -35,18 +35,17 @@ import org.apache.camel.util.ObjectHelper;
/**
* Query or transform JSON payloads using an JSLT.
- *
- * @author JiriOndrusek
*/
@UriEndpoint(firstVersion = "3.1.0", scheme = "jslt", title = "JSLT", syntax = "jslt:resourceUri", producerOnly = true, label = "transformation")
public class JsltEndpoint extends ResourceEndpoint {
private Expression transform;
+ @UriParam(defaultValue = "false")
+ private boolean allowTemplateFromHeader;
@UriParam(defaultValue = "false", label = "common")
private boolean prettyPrint;
-
public JsltEndpoint() {
}
@@ -71,7 +70,7 @@ public class JsltEndpoint extends ResourceEndpoint {
log.debug("Jslt content read from resource {} with resourceUri: {} for endpoint {}", getResourceUri(), path, getEndpointUri());
}
- String jsltStringFromHeader = msg.getHeader(JsltConstants.HEADER_JSLT_STRING, String.class);
+ String jsltStringFromHeader = allowTemplateFromHeader ? msg.getHeader(JsltConstants.HEADER_JSLT_STRING, String.class) : null;
Collection<Function> functions = ((JsltComponent)getComponent()).getFunctions();
if (jsltStringFromHeader != null) {
@@ -103,7 +102,10 @@ public class JsltEndpoint extends ResourceEndpoint {
String path = getResourceUri();
ObjectHelper.notNull(path, "resourceUri");
- String newResourceUri = exchange.getIn().getHeader(JsltConstants.HEADER_JSLT_RESOURCE_URI, String.class);
+ String newResourceUri = null;
+ if (allowTemplateFromHeader) {
+ newResourceUri = exchange.getIn().getHeader(JsltConstants.HEADER_JSLT_RESOURCE_URI, String.class);
+ }
if (newResourceUri != null) {
exchange.getIn().removeHeader(JsltConstants.HEADER_JSLT_RESOURCE_URI);
@@ -126,11 +128,8 @@ public class JsltEndpoint extends ResourceEndpoint {
}
JsonNode output = getTransform(exchange.getMessage()).apply(input);
-
Message out = exchange.getMessage();
-
out.setBody(isPrettyPrint() ? output.toPrettyString() : output.toString());
-
out.setHeaders(exchange.getIn().getHeaders());
}
@@ -144,4 +143,19 @@ public class JsltEndpoint extends ResourceEndpoint {
public void setPrettyPrint(boolean prettyPrint) {
this.prettyPrint = prettyPrint;
}
+
+ public boolean isAllowTemplateFromHeader() {
+ return allowTemplateFromHeader;
+ }
+
+ /**
+ * Whether to allow to use resource template from header or not (default false).
+ *
+ * Enabling this allows to specify dynamic templates via message header. However this can
+ * be seen as a potential security vulnerability if the header is coming from a malicious user, so use this with care.
+ */
+ public void setAllowTemplateFromHeader(boolean allowTemplateFromHeader) {
+ this.allowTemplateFromHeader = allowTemplateFromHeader;
+ }
+
}
diff --git a/components/camel-jslt/src/test/java/org/apache/camel/component/jslt/JsltBasicTest.java b/components/camel-jslt/src/test/java/org/apache/camel/component/jslt/JsltBasicTest.java
index 45c2fb7..46081a2 100644
--- a/components/camel-jslt/src/test/java/org/apache/camel/component/jslt/JsltBasicTest.java
+++ b/components/camel-jslt/src/test/java/org/apache/camel/component/jslt/JsltBasicTest.java
@@ -103,7 +103,7 @@ public class JsltBasicTest extends CamelTestSupport {
.to("mock:result");
from("direct://startPrettyPrint")
- .to("jslt:dummy?prettyPrint=true")
+ .to("jslt:dummy?prettyPrint=true&allowTemplateFromHeader=true")
.to("mock:result");
}
};
diff --git a/components/camel-jslt/src/test/java/org/apache/camel/component/jslt/JsltFunctionsTest.java b/components/camel-jslt/src/test/java/org/apache/camel/component/jslt/JsltFunctionsTest.java
index b8ee54e..bb58d80 100644
--- a/components/camel-jslt/src/test/java/org/apache/camel/component/jslt/JsltFunctionsTest.java
+++ b/components/camel-jslt/src/test/java/org/apache/camel/component/jslt/JsltFunctionsTest.java
@@ -62,6 +62,9 @@ public class JsltFunctionsTest extends CamelTestSupport {
protected RouteBuilder createRouteBuilder() throws Exception {
return new RouteBuilder() {
public void configure() {
+ JsltComponent js = context.getComponent("jslt", JsltComponent.class);
+ js.setAllowTemplateFromHeader(true);
+
from("direct://start")
.to("jslt:dummy")
.to("mock:result");
diff --git a/components/camel-jslt/src/test/java/org/apache/camel/component/jslt/JsltQueryTest.java b/components/camel-jslt/src/test/java/org/apache/camel/component/jslt/JsltQueryTest.java
index e62acc7..a721d38 100644
--- a/components/camel-jslt/src/test/java/org/apache/camel/component/jslt/JsltQueryTest.java
+++ b/components/camel-jslt/src/test/java/org/apache/camel/component/jslt/JsltQueryTest.java
@@ -29,7 +29,6 @@ import org.junit.Test;
*/
public class JsltQueryTest extends CamelTestSupport {
-
@Test
public void testSimpleQuery() throws Exception {
getMockEndpoint("mock:result").expectedMinimumMessageCount(1);
@@ -49,7 +48,7 @@ public class JsltQueryTest extends CamelTestSupport {
return new RouteBuilder() {
public void configure() {
from("direct://start")
- .to("jslt:dummy")
+ .to("jslt:dummy?allowTemplateFromHeader=true")
.to("mock:result");
}
};
diff --git a/core/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/JsltComponentBuilderFactory.java b/core/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/JsltComponentBuilderFactory.java
index c1e64af..68a28c3 100644
--- a/core/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/JsltComponentBuilderFactory.java
+++ b/core/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/JsltComponentBuilderFactory.java
@@ -47,6 +47,23 @@ public interface JsltComponentBuilderFactory {
*/
interface JsltComponentBuilder extends ComponentBuilder<JsltComponent> {
/**
+ * Whether to allow to use resource template from header or not (default
+ * false). Enabling this allows to specify dynamic templates via message
+ * header. However this can be seen as a potential security
+ * vulnerability if the header is coming from a malicious user, so use
+ * this with care.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: false
+ * Group: producer
+ */
+ default JsltComponentBuilder allowTemplateFromHeader(
+ boolean allowTemplateFromHeader) {
+ doSetProperty("allowTemplateFromHeader", allowTemplateFromHeader);
+ return this;
+ }
+ /**
* Whether the producer should be started lazy (on the first message).
* By starting lazy you can use this to allow CamelContext and routes to
* startup in situations where a producer may otherwise fail during
@@ -110,6 +127,7 @@ public interface JsltComponentBuilderFactory {
String name,
Object value) {
switch (name) {
+ case "allowTemplateFromHeader": ((JsltComponent) component).setAllowTemplateFromHeader((boolean) value); return true;
case "lazyStartProducer": ((JsltComponent) component).setLazyStartProducer((boolean) value); return true;
case "basicPropertyBinding": ((JsltComponent) component).setBasicPropertyBinding((boolean) value); return true;
case "functions": ((JsltComponent) component).setFunctions((java.util.Collection) value); return true;
diff --git a/core/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/JsltEndpointBuilderFactory.java b/core/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/JsltEndpointBuilderFactory.java
index 31797ff..bc07a71 100644
--- a/core/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/JsltEndpointBuilderFactory.java
+++ b/core/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/JsltEndpointBuilderFactory.java
@@ -38,6 +38,40 @@ public interface JsltEndpointBuilderFactory {
return (AdvancedJsltEndpointBuilder) this;
}
/**
+ * Whether to allow to use resource template from header or not (default
+ * false). Enabling this allows to specify dynamic templates via message
+ * header. However this can be seen as a potential security
+ * vulnerability if the header is coming from a malicious user, so use
+ * this with care.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: false
+ * Group: producer
+ */
+ default JsltEndpointBuilder allowTemplateFromHeader(
+ boolean allowTemplateFromHeader) {
+ doSetProperty("allowTemplateFromHeader", allowTemplateFromHeader);
+ return this;
+ }
+ /**
+ * Whether to allow to use resource template from header or not (default
+ * false). Enabling this allows to specify dynamic templates via message
+ * header. However this can be seen as a potential security
+ * vulnerability if the header is coming from a malicious user, so use
+ * this with care.
+ *
+ * The option will be converted to a <code>boolean</code> type.
+ *
+ * Default: false
+ * Group: producer
+ */
+ default JsltEndpointBuilder allowTemplateFromHeader(
+ String allowTemplateFromHeader) {
+ doSetProperty("allowTemplateFromHeader", allowTemplateFromHeader);
+ return this;
+ }
+ /**
* Sets whether to use resource content cache or not.
*
* The option is a: <code>boolean</code> type.