[
https://issues.apache.org/jira/browse/CAMEL-23411?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18099609#comment-18099609
]
Adriano Machado commented on CAMEL-23411:
-----------------------------------------
h2. Investigation: Caffeine 3.2.4 "serialization filter" vs. camel\-caffeine
I reviewed the referenced commit
\({{2f8825395e382522fc6115e0cd88eecd0dc39b52}}\) against the Caffeine _source_
\(not just the published jar\), at tag {{v3.2.4}}.
_Finding: the new serialization filter is scoped to the JCache \(JSR\-107\)
module only, and camel\-caffeine does not use it._
h3. What the commit actually changed
The commit modifies exactly three files, all under the {{jcache}} module:
* {{jcache/build.gradle.kts}}
*
{{jcache/src/main/java/com/github/benmanes/caffeine/jcache/copy/JavaSerializationCopier.java}}
*
{{jcache/src/test/java/com/github/benmanes/caffeine/jcache/copy/JavaSerializationCopierTest.java}}
There are _no changes to the core cache module_ \({{caffeine/src/main}}\). The
core {{SerializationProxy}} at {{v3.2.4}} contains no {{ObjectInputFilter}} and
no {{readObject}} hook, and the {{Caffeine}} builder has no filter method.
The new API is an optional {{ObjectInputFilter}} on the JSR\-107 {{Copier}}:
{code:java}
public JavaSerializationCopier\(Set> immutableClasses,
Map, Function> deepCopyStrategies,
ObjectInputFilter objectInputFilter\)
// ...
stream.setObjectInputFilter\(objectInputFilter\);
{code}
This {{Copier}} is only exercised when Caffeine is used as a store\-by\-value
JSR\-107 {{CachingProvider}} that deep\-copies entries by serializing and
deserializing them.
h3. Why this does not map onto camel\-caffeine
* camel\-caffeine depends only on the core {{caffeine}} artifact, not
{{caffeine\-jcache}}. The {{JavaSerializationCopier}} class is not on the
classpath \(zero references in the component\).
* All component caches are core store\-by\-reference {{Cache}} instances.
Entries are held as live object references in the JVM heap; Caffeine never
serializes or deserializes them.
* The aggregation repository \({{CaffeineAggregationRepository}}\) stores
{{DefaultExchangeHolder}} objects directly \({{cache.put}} /
{{cache.getIfPresent}}\). The only serialization involved is Camel's own
{{DefaultExchangeHolder.marshal/unmarshal}} of Serializable header values,
gated by the existing {{allowSerializedHeaders}} option \(already annotated
{{security = "insecure:serialization"}}\). That is a Camel concern, not
Caffeine's filter.
h3. Suggested next steps \(leaving this issue open for discussion\)
Because there is no Caffeine deserialization path in the component, the
Caffeine {{ObjectInputFilter}} cannot be wired in as\-is. Options worth
considering:
* Documentation only: note that camel\-caffeine caches store\-by\-reference and
do not deserialize through Caffeine.
* If hardening of the aggregation repository's serialized headers is desired,
that belongs to Camel's own serialization\-filter controls \(e.g. the security
policy framework from CAMEL\-23250\), independent of Caffeine.
* Only if a JSR\-107 store\-by\-value mode were ever added to camel\-caffeine
would the {{JavaSerializationCopier}} \+ filter become relevant.
_Claude Code on behalf of Adriano Machado_
> Support Object filter for caffeine cache
> ----------------------------------------
>
> Key: CAMEL-23411
> URL: https://issues.apache.org/jira/browse/CAMEL-23411
> Project: Camel
> Issue Type: Task
> Components: camel-caffeine
> Reporter: Aurélien Pupier
> Assignee: Adriano Machado
> Priority: Major
>
> Caffeine 3.2.4 introduced a serialization filter
> https://github.com/ben-manes/caffeine/commit/2f8825395e382522fc6115e0cd88eecd0dc39b52
> Would be nice to look if this is something that can be used by the component
> and potentially introduce a component parameter for that
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
