[jira] [Updated] (CAMEL-24113) camel-rest-openapi: producers for the same operation share one cached rest: delegate endpoint - produces/consumes/queryParameters cross-contamination between routes

["Claus Ibsen (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24113?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Claus Ibsen updated CAMEL-24113:
--------------------------------
    Fix Version/s: 4.22.0

> camel-rest-openapi: producers for the same operation share one cached rest: delegate endpoint - produces/consumes/queryParameters cross-contamination between routes
> --------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24113
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24113
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-rest-openapi
>    Affects Versions: 4.21.0
>            Reporter: Federico Mariani
>            Assignee: Claus Ibsen
>            Priority: Major
>              Labels: code-review
>             Fix For: 4.22.0
>
>
> h3. Problem
> {{RestOpenApiEndpoint.createProducerFor()}} (RestOpenApiEndpoint.java:550-557) builds the delegate URI from method/basePath/uriTemplate/host only, obtains it via {{camelContext.getEndpoint(componentEndpointUri)}} (cached by URI), then mutates it with {{endpoint.configureProperties(params)}} carrying {{produces}}, {{consumes}}, {{queryParameters}} (including endpoint-level literal query parameter values), {{producerComponentName}} and {{parameters}}. Two rest-openapi endpoints that resolve to the same operation/host but differ in those options alias the *same* {{RestEndpoint}} instance - the last {{configureProperties}} wins for both. {{RestProducer.prepareExchange}} reads {{getEndpoint().getProduces()/getConsumes()/getQueryParameters()}} at runtime, so the first route silently switches to the second route's configuration.
> h3. Failure scenario
> Two routes in one context: {{to("rest-openapi:petstore.json#findPetsByStatus?status=available")}} and {{to("rest-openapi:petstore.json#findPetsByStatus?status=sold")}}. Both resolve to {{rest:GET:/v3:/pet/findByStatus?host=...}} -> same cached endpoint; the second startup call overwrites {{queryParameters}} -> route 1 now sends {{status=sold}}. Same for {{produces=application/json}} vs {{produces=application/xml}} (Content-Type of route 1 flips to XML).
> h3. History
> Pattern unchanged since the original rest-swagger component; 5133ca3e38b5 (CAMEL-14516) only switched to configurer usage. No JIRA acknowledges the aliasing.
> h3. Fix direction
> Encode the distinguishing options into the {{rest:}} endpoint URI (options are part of the endpoint cache key), or create the delegate as a prototype/non-cached endpoint so each rest-openapi producer owns its own instance.
> ----
> _This issue was researched and filed by Claude Code on behalf of [~croway] (GitHub: Croway), as part of a deep code review of camel-rest-openapi and camel-openapi-java on main (4.22.0-SNAPSHOT). Full findings document available on request._



--
This message was sent by Atlassian Jira
(v8.20.10#820010)