[
https://issues.apache.org/jira/browse/CAMEL-24296?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen updated CAMEL-24296:
--------------------------------
Fix Version/s: 4.22.0
> camel-core: allow configuring a JEP-290 ObjectInputFilter on
> CamelObjectInputStream
> -----------------------------------------------------------------------------------
>
> Key: CAMEL-24296
> URL: https://issues.apache.org/jira/browse/CAMEL-24296
> Project: Camel
> Issue Type: Improvement
> Components: camel-core
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.22.0
>
>
> CamelObjectInputStream (camel-support) overrides resolveClass to swap the
> classloader but installs no java.io.ObjectInputFilter. As the shared helper
> used by downstream deserialisation consumers (SerializationDataFormat,
> aggregation repositories, JMS), it would benefit from an optional
> CamelContext-configurable allow-list installed via setObjectInputFilter(), so
> every downstream caller inherits it. Defensive hardening; must default to
> non-restrictive behaviour to preserve compatibility.
> _Filed by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
