[
https://issues.apache.org/jira/browse/CAMEL-24718?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18117710#comment-18117710
]
Andrea Cosentino commented on CAMEL-24718:
------------------------------------------
PR opened: https://github.com/apache/camel/pull/26689
All three call sites named in this issue now consult the endpoint's
{{allowQueryFromHeader}} option before using the {{CamelSqlQuery}} header,
reading it through the generated PropertyConfigurer so that camel-telemetry,
camel-tracing and camel-console keep no dependency on camel-sql.
No backport is needed: {{allowQueryFromHeader}} ships in 4.23.0, so on 4.14.x /
4.18.x camel-sql always honours the header and the current observability
behaviour is already correct there.
_Claude Code on behalf of oscerd_
> camel-sql - observability (SqlTraceDevConsole, SqlSpanDecorator) surfaces the
> CamelSqlQuery header even when allowQueryFromHeader is disabled
> ---------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24718
> URL: https://issues.apache.org/jira/browse/CAMEL-24718
> Project: Camel
> Issue Type: Bug
> Components: camel-sql
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
>
> Follow-up to CAMEL-24292.
> CAMEL-24292 gates the CamelSqlQuery header behind a new allowQueryFromHeader
> option (default false), so by default a message carrying CamelSqlQuery no
> longer changes the executed SQL. However, three observability sites still
> read that header unconditionally and prefer/tag it, so with the gate off they
> display or trace a statement that was never executed:
> * core/camel-console - SqlTraceDevConsole (around line 276-281): the comment
> reads "prefer the CamelSqlQuery header (runtime override) over the URI" and
> it reports the header value as the executed query. This console also handles
> jdbc:, so it cannot simply drop the header - it must consult the owning
> endpoint's allowQueryFromHeader flag.
> * components/camel-telemetry - SqlSpanDecorator (line 43-45): writes the
> header to the DB_STATEMENT span tag.
> * components/camel-tracing - SqlSpanDecorator (line 44-46): same.
> Beyond being misleading, the telemetry/tracing decorators place
> attacker-controlled header text into span tags for a query that was rejected.
> Fix: gate each read on the endpoint's allowQueryFromHeader so the header
> value is only surfaced when the override is actually enabled (and therefore
> actually executed).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
