You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by fm...@apache.org on 2026/09/09 14:57:40 UTC
(camel-spring-boot) branch camel-spring-boot-4.22.x updated: CAMEL-24503: camel-spring-boot - see camel properties supplied as environment variables
This is an automated email from the ASF dual-hosted git repository.
Croway pushed a commit to branch camel-spring-boot-4.22.x
in repository https://gitbox.apache.org/repos/asf/camel-spring-boot.git
The following commit(s) were added to refs/heads/camel-spring-boot-4.22.x by this push:
new a138212474f CAMEL-24503: camel-spring-boot - see camel properties supplied as environment variables
a138212474f is described below
commit a138212474f4aba0e58437634d3da10fa5ae4c38
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Fri Aug 28 09:53:54 2026 +0200
CAMEL-24503: camel-spring-boot - see camel properties supplied as environment variables
extractCamelProperties filtered on the property name exactly as its source
reports it. The systemEnvironment source reports environment variables in their
native CAMEL_COMPONENT_FOO_BAR form, which never matches the "camel." prefix, so
any Camel option configured through the environment was invisible to the
camel.security policy check added in CAMEL-23250 - even though Spring's relaxed
binding applies it to the component regardless.
That is the usual way to configure a containerised application, so the check was
blind to a large part of real deployments.
Names are now canonicalized with ConfigurationPropertyName.adapt before the
prefix test, and the canonical name is used for the lookup so relaxed binding
resolves it back to the variable. SecurityUtils.getSecurityOption already
lowercases and strips dashes, so the canonical name matches the same option.
Co-Authored-By: Claude Opus 5 (1M context) <no...@anthropic.com>
Signed-off-by: Andrea Cosentino <an...@gmail.com>
(cherry picked from commit 27fb340edbd0d3936262736073bc6287debc5107)
---
.../CamelSecurityPolicyAutoConfiguration.java | 31 ++++++++++++++++--
.../CamelSecurityPolicyAutoConfigurationTest.java | 37 ++++++++++++++++++++++
2 files changed, 65 insertions(+), 3 deletions(-)
diff --git a/core/camel-spring-boot/src/main/java/org/apache/camel/spring/boot/security/CamelSecurityPolicyAutoConfiguration.java b/core/camel-spring-boot/src/main/java/org/apache/camel/spring/boot/security/CamelSecurityPolicyAutoConfiguration.java
index 93d2dcbd6dc..77a0f118d5e 100644
--- a/core/camel-spring-boot/src/main/java/org/apache/camel/spring/boot/security/CamelSecurityPolicyAutoConfiguration.java
+++ b/core/camel-spring-boot/src/main/java/org/apache/camel/spring/boot/security/CamelSecurityPolicyAutoConfiguration.java
@@ -34,6 +34,7 @@ import org.slf4j.LoggerFactory;
import org.springframework.boot.autoconfigure.AutoConfiguration;
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.boot.context.properties.source.ConfigurationPropertyName;
import org.springframework.context.annotation.Bean;
import org.springframework.core.env.ConfigurableEnvironment;
import org.springframework.core.env.EnumerablePropertySource;
@@ -45,6 +46,7 @@ import org.springframework.core.env.Environment;
public class CamelSecurityPolicyAutoConfiguration {
private static final Logger LOG = LoggerFactory.getLogger(CamelSecurityPolicyAutoConfiguration.class);
+ private static final String CAMEL_PREFIX = "camel.";
@Bean
SecurityPolicyResult camelSecurityPolicyResult(CamelContext camelContext,
@@ -111,10 +113,11 @@ public class CamelSecurityPolicyAutoConfiguration {
ce.getPropertySources().forEach(ps -> {
if (ps instanceof EnumerablePropertySource<?> eps) {
for (String name : eps.getPropertyNames()) {
- if (name != null && name.startsWith("camel.") && !name.startsWith("camel.security.")) {
- Object value = environment.getProperty(name);
+ String canonical = canonicalCamelName(name);
+ if (canonical != null && !canonical.startsWith("camel.security.")) {
+ Object value = environment.getProperty(canonical);
if (value != null) {
- properties.putIfAbsent(name, value);
+ properties.putIfAbsent(canonical, value);
}
}
}
@@ -125,6 +128,28 @@ public class CamelSecurityPolicyAutoConfiguration {
return properties;
}
+ /**
+ * Canonicalizes a property name as its source reports it, returning <tt>null</tt> when it is not a Camel
+ * property.
+ * <p/>
+ * Property sources report names in their own form: an option set in application.properties arrives as
+ * <tt>camel.component.foo.bar</tt>, while the same option set as an environment variable arrives as
+ * <tt>CAMEL_COMPONENT_FOO_BAR</tt>. Spring's relaxed binding applies both to the same option, so both have to
+ * be recognised here - otherwise every option configured through the environment, which is the usual way to
+ * configure a containerised application, is invisible to the policy check.
+ */
+ private static String canonicalCamelName(String name) {
+ if (name == null) {
+ return null;
+ }
+ if (name.startsWith(CAMEL_PREFIX)) {
+ return name;
+ }
+ ConfigurationPropertyName adapted = ConfigurationPropertyName.adapt(name, '_');
+ String canonical = adapted.toString();
+ return canonical.startsWith(CAMEL_PREFIX) ? canonical : null;
+ }
+
private static boolean containsSensitive(CamelContext camelContext, String key, Object value) {
boolean answer = CamelContextHelper.containsSensitive(camelContext, key);
if (!answer && value != null) {
diff --git a/core/camel-spring-boot/src/test/java/org/apache/camel/spring/boot/security/CamelSecurityPolicyAutoConfigurationTest.java b/core/camel-spring-boot/src/test/java/org/apache/camel/spring/boot/security/CamelSecurityPolicyAutoConfigurationTest.java
index b7b7cf20a8f..6d50f9f4012 100644
--- a/core/camel-spring-boot/src/test/java/org/apache/camel/spring/boot/security/CamelSecurityPolicyAutoConfigurationTest.java
+++ b/core/camel-spring-boot/src/test/java/org/apache/camel/spring/boot/security/CamelSecurityPolicyAutoConfigurationTest.java
@@ -22,6 +22,9 @@ import org.apache.camel.RuntimeCamelException;
import org.apache.camel.main.SecurityPolicyResult;
import org.apache.camel.spring.boot.CamelAutoConfiguration;
import org.junit.jupiter.api.Test;
+import org.springframework.core.env.SystemEnvironmentPropertySource;
+
+import java.util.Map;
import org.springframework.boot.autoconfigure.AutoConfigurations;
import org.springframework.boot.test.context.runner.ApplicationContextRunner;
@@ -132,4 +135,38 @@ public class CamelSecurityPolicyAutoConfigurationTest {
});
}
+
+ /**
+ * The same option configured as an environment variable arrives as CAMEL_COMPONENT_HTTP_TRUSTALLCERTIFICATES,
+ * which never matched the "camel." prefix - so every option set through the environment, the usual way to
+ * configure a containerised application, escaped the policy check entirely.
+ */
+ @Test
+ public void policyShouldSeeInsecureOptionsSetThroughTheEnvironment() {
+ runner.withPropertyValues("camel.security.policy=warn")
+ .withInitializer(ctx -> ctx.getEnvironment().getPropertySources()
+ .addFirst(new SystemEnvironmentPropertySource("testSystemEnvironment",
+ Map.of("CAMEL_COMPONENT_HTTP_TRUSTALLCERTIFICATES", "true"))))
+ .run(context -> {
+ assertThat(context).hasNotFailed();
+ SecurityPolicyResult result = context.getBean(SecurityPolicyResult.class);
+ assertThat(result.hasViolations()).isTrue();
+ assertThat(result.getViolations())
+ .anySatisfy(v -> assertThat(v.propertyKey()).endsWith("trustallcertificates"));
+ });
+ }
+
+ @Test
+ public void environmentVariablesUnrelatedToCamelAreIgnored() {
+ runner.withPropertyValues("camel.security.policy=warn")
+ .withInitializer(ctx -> ctx.getEnvironment().getPropertySources()
+ .addFirst(new SystemEnvironmentPropertySource("testSystemEnvironment",
+ Map.of("SOME_OTHER_TRUSTALLCERTIFICATES", "true"))))
+ .run(context -> {
+ assertThat(context).hasNotFailed();
+ SecurityPolicyResult result = context.getBean(SecurityPolicyResult.class);
+ assertThat(result.hasViolations()).isFalse();
+ });
+ }
+
}