Andrea Cosentino created CAMEL-25226:
----------------------------------------
Summary: camel-fory: requireClassRegistration option missing
security="insecure:serialization" annotation
Key: CAMEL-25226
URL: https://issues.apache.org/jira/browse/CAMEL-25226
Project: Camel
Issue Type: Task
Components: camel-fory
Reporter: Andrea Cosentino
The +requireClassRegistration+ option in +ForyDataFormat+ controls whether
Apache Fory enforces class allowlisting during deserialization. When set to
+false+, Fory will deserialize any class present in the wire payload (unsafe
deserialization).
Every other component that exposes a similar unsafe-deserialization opt-in (30+
components: camel-avro, camel-jms, camel-netty, camel-mina, etc.) carries the
+@Metadata(security = "insecure:serialization")+ annotation. This annotation
enables the Camel security policy framework (+camel.main.profile=prod+) to
detect and reject this unsafe configuration at startup.
The +requireClassRegistration+ field in +ForyDataFormat+ is missing this
annotation. Default value is +true+ (safe), so this is an annotation/hardening
gap rather than a default exposure.
*Fix:* Add +@Metadata(label = "security", security = "insecure:serialization",
insecureValue = "false")+ to the +requireClassRegistration+ field and
regenerate component metadata.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
