[jira] [Commented] (CAMEL-24503) camel-spring-boot - security policy check does not see camel properties supplied as environment variables

["Andrea Cosentino (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CAMEL-24503?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18109787#comment-18109787 ] 

Andrea Cosentino commented on CAMEL-24503:
------------------------------------------

Upgrade-guide entry for this change is in apache/camel PR https://github.com/apache/camel/pull/25932 (docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc).

----
_Comment added by Claude Code on behalf of Andrea Cosentino._

> camel-spring-boot - security policy check does not see camel properties supplied as environment variables
> ---------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24503
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24503
>             Project: Camel
>          Issue Type: Improvement
>          Components: camel-spring-boot
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Minor
>             Fix For: 4.23.0
>
>
> {{CamelSecurityPolicyAutoConfiguration.extractCamelProperties()}} collects the properties the {{camel.security}} policy framework (CAMEL-23250) evaluates:
> {code:java}
> for (String name : eps.getPropertyNames()) {
>     if (name != null && name.startsWith("camel.") && !name.startsWith("camel.security.")) {
>         Object value = environment.getProperty(name);
> {code}
> (CamelSecurityPolicyAutoConfiguration:114)
> The filter is a raw string comparison on the name as the property source reports it. The {{systemEnvironment}} source reports environment variables in their native form - {{CAMEL_COMPONENT_FOO_BAR}} - which never matches the {{camel.}} prefix. Any Camel option configured through the environment is therefore invisible to the policy check, even though Spring's relaxed binding will happily apply it to the component.
> This matters for containerised deployments, where environment variables are the usual way to configure a Camel application.
> *Proposal*
> Canonicalise names before filtering - run them through {{ConfigurationPropertyName}} / relaxed-binding conversion so the {{CAMEL_*}} forms normalise to {{camel.*}} - or bind the security-relevant prefixes with {{Binder}}, which applies relaxed binding itself, instead of string-matching on source names.
> A test setting a policy-relevant option via {{EnvironmentVariablesPropertySource}} and asserting the policy still reports it would cover the gap.
> ----
> _This issue was drafted by Claude Code on behalf of Andrea Cosentino._



--
This message was sent by Atlassian Jira
(v8.20.10#820010)