[
https://issues.apache.org/jira/browse/CAMEL-24370?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino updated CAMEL-24370:
-------------------------------------
Fix Version/s: 4.22.0
> camel-netty - resolve the shared deserialization filter in the object codecs
> and expose deserializationFilter on the endpoint
> -----------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24370
> URL: https://issues.apache.org/jira/browse/CAMEL-24370
> Project: Camel
> Issue Type: Improvement
> Components: camel-netty
> Reporter: Andrea Cosentino
> Priority: Major
> Fix For: 4.22.0
>
>
> h3. Background
> The camel-netty object codecs are the last Java-serialization entry points in
> the component tree that do not resolve their {{ObjectInputFilter}} through
> the shared {{DeserializationFilterHelper}} introduced in CAMEL-23815.
> h3. Current state
> * {{org.apache.camel.component.netty.codec.ObjectDecoder}} sets an
> {{ObjectInputFilter}} only when the {{deserializationFilter}} constructor
> argument is non-null. The single-argument constructor passes {{null}}, so
> decoders built that way apply no filter at all and only emit a WARN log.
> * {{org.apache.camel.component.netty.codec.DatagramPacketObjectDecoder}}
> inherits the same behaviour by delegation.
> * Within the same component, {{NettyConverter}} already calls
> {{DeserializationFilterHelper.resolveDeserializationFilter(null)}}, so the
> type-converter path and the codec path behave inconsistently.
> * The netty endpoint exposes no {{deserializationFilter}} option, while
> camel-netty-http and twelve other components do.
> h3. Proposed change
> # Resolve the filter in {{ObjectDecoder}} through
> {{DeserializationFilterHelper.resolveDeserializationFilter(...)}}, so that an
> unset pattern falls back to the JVM-wide {{jdk.serialFilter}} and then to the
> shared Camel default instead of applying no filter.
> # Add a {{deserializationFilter}} option on the netty component and endpoint
> for parity with camel-netty-http, and thread it through to the codecs.
> # Document the option and the recommended setting for routes that use the
> {{ObjectEncoder}} / {{ObjectDecoder}} pair in {{netty-component.adoc}}.
> h3. Compatibility
> This is a behaviour change for existing routes that wire {{ObjectDecoder}}
> explicitly: classes outside the default allow-list will start to be rejected.
> It needs an entry in
> {{docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc}}.
> h3. Related
> CAMEL-23297 added the {{deserializationFilter}} argument to these codecs,
> CAMEL-23815 introduced the shared helper, and CAMEL-24296 applied the same
> default to {{CamelObjectInputStream}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
