Andrea Cosentino created CAMEL-24421:
----------------------------------------
Summary: camel-spring-redis: apply a configurable
ObjectInputFilter to the default JDK serializer
Key: CAMEL-24421
URL: https://issues.apache.org/jira/browse/CAMEL-24421
Project: Camel
Issue Type: Improvement
Components: camel-spring-redis
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
camel-spring-redis builds JdkSerializationRedisSerializer as its default
serializer in RedisConfiguration.createDefaultSerializer(). Unlike the other
Camel components that perform JDK deserialization -- camel-consul,
camel-leveldb, camel-mina, camel-netty, camel-netty-http, camel-vertx-http,
camel-jms, camel-sjms, camel-http-common, camel-cassandraql -- this path
installs no ObjectInputFilter, so it does not participate in the filtering the
rest of the codebase applies.
Bring it in line with the rest of the codebase:
* Add a "deserializationFilter" option (label advanced,security) with the
standard default pattern.
* Apply it to the serializer used by RedisConsumer.setBody().
* Apply it to the default template built in
RedisConfiguration.createDefaultTemplate(), and therefore to
SpringRedisIdempotentRepository, which shares that template.
Implementation note: JdkSerializationRedisSerializer exposes no filter hook.
Use its (Converter<Object,byte[]>, Converter<byte[],Object>) constructor with a
filtering deserializer, or a Camel-owned RedisSerializer.
Note that setting a custom redisTemplate does not currently affect the
consumer, which reads getSerializer() directly -- the option needs to cover
both paths.
Affected branches: main (4.23.0), camel-4.22.x, camel-4.18.x, camel-4.14.x. On
4.18.x and 4.14.x, DeserializationFilterHelper does not exist; follow the
local-constant pattern already used there by NettyHttpHelper, JmsBinding and
MinaConverter.
This changes a default, so it needs an upgrade-guide entry on main.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
