[
https://issues.apache.org/jira/browse/CAMEL-24296?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18102399#comment-18102399
]
Andrea Cosentino commented on CAMEL-24296:
------------------------------------------
PR opened: https://github.com/apache/camel/pull/25378 - CamelObjectInputStream
now installs a JEP-290 ObjectInputFilter by default (via
DeserializationFilterHelper), with an explicit-pattern constructor; HttpHelper
refactored to use it.
> camel-core: allow configuring a JEP-290 ObjectInputFilter on
> CamelObjectInputStream
> -----------------------------------------------------------------------------------
>
> Key: CAMEL-24296
> URL: https://issues.apache.org/jira/browse/CAMEL-24296
> Project: Camel
> Issue Type: Improvement
> Components: camel-core
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
>
> CamelObjectInputStream (camel-support) overrides resolveClass to swap the
> classloader but installs no java.io.ObjectInputFilter. As the shared helper
> used by downstream deserialisation consumers (SerializationDataFormat,
> aggregation repositories, JMS), it would benefit from an optional
> CamelContext-configurable allow-list installed via setObjectInputFilter(), so
> every downstream caller inherits it. Defensive hardening; must default to
> non-restrictive behaviour to preserve compatibility.
> _Filed by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
