[
https://issues.apache.org/jira/browse/CAMEL-24295?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18119085#comment-18119085
]
Andrea Cosentino commented on CAMEL-24295:
------------------------------------------
Correcting two things in my previous comment — the substance of the
recommendation stands, but point 2 was overstated.
h3. The "distinctive compounds" claim was wrong
I wrote that "all 39 current keys are distinctive compounds". That is false.
The map already contains short, generic keys: {{tls}} (3 characters),
{{failopen}}, {{verifyssl}}. So {{nested}} would not be "by far the most
generic" — {{tls}} already is, and it has not caused a reported problem.
h3. The collision risk is latent, not demonstrated
I then scanned all 7552 option names in the catalog for suffix collisions
against each of the 39 keys, plus a hypothetical {{nested}} key. Result: *zero*
collisions in either case. So the concrete false-positive scenario I sketched
({{isNested=true}}, {{unnested: true}}) is not backed by anything in the
catalog.
The unanchored {{indexOf}} in {{extractOptionValue}} is still a real weakness —
the scanner reads arbitrary route source text, which the catalog cannot speak
to, so a user-defined bean property or YAML field ending in a key name would
still match. But that is a latent risk in the scanner, not evidence that adding
{{nested}} would break anything today. Point 2 should be read as "the scanner's
matching is unanchored and should be fixed", not as "adding {{nested}} will
produce false positives".
h3. What is unchanged
Point 1 is unaffected and remains the load-bearing argument:
{{BaseMainSupport.enforceSecurityPolicies}} only tests {{camel.*}} properties
from {{autoConfiguredProperties}}, so a route-inline {{nested}} attribute never
reaches the prod-profile detector regardless of the marker. Marking the option
still buys no {{camel.main.profile=prod}} coverage.
With point 2 weakened, the cost of adding the marker is lower than I implied —
so if you want it in place ahead of the scanner work, the objection is now
mostly that it is inert rather than that it is harmful.
_Correction by Claude Code on behalf of Andrea Cosentino_
> camel-core: mark the Simple nested option with security metadata
> ----------------------------------------------------------------
>
> Key: CAMEL-24295
> URL: https://issues.apache.org/jira/browse/CAMEL-24295
> Project: Camel
> Issue Type: Improvement
> Components: camel-core
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
>
> The Simple language nested option (SimpleExpression, default false)
> re-evaluates a nested Simple expression contained in the result. It is off by
> default. Unlike other opt-in options with security relevance it carries no
> security metadata marker, so the production-profile policy has no visibility
> of it. Suggested: add security="insecure:dev" (and a security label) on the
> nested @Metadata so camel.main.profile=prod can surface routes that enable
> it. Metadata-only change (regenerates catalog).
> _Filed by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
