[
https://issues.apache.org/jira/browse/CAMEL-25602?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen updated CAMEL-25602:
--------------------------------
Fix Version/s: 4.24.0
> camel-http-common - the published endpoint default for muteException is false
> while the effective default is true (servlet, jetty, atmosphere-websocket)
> --------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-25602
> URL: https://issues.apache.org/jira/browse/CAMEL-25602
> Project: Camel
> Issue Type: Bug
> Components: camel-atmosphere-websocket, camel-http-common,
> camel-jetty, camel-servlet
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.24.0
>
>
> {{HttpCommonEndpoint.muteException}} is annotated without a {{defaultValue}}:
> {code:java}
> @UriParam(label = "consumer",
> description = "If enabled and an Exchange failed processing on the
> consumer side the response's body won't contain the exception's stack trace.")
> boolean muteException;
> {code}
> so the catalog records Java's {{false}}. The effective default is {{true}}:
> {{HttpCommonComponent}} has {{protected boolean muteException = true}}, and
> the components read the URI parameter using that as the fallback and then set
> it on the endpoint -
> {code:java}
> // ServletComponent
> boolean muteException = getAndRemoveParameter(parameters, "muteException",
> boolean.class, isMuteException());
> ...
> endpoint.setMuteException(muteException);
> {code}
> (the same two lines are in {{JettyHttpComponent}}). So the endpoint's Java
> {{false}} is always overwritten for an endpoint created the normal way.
> h2. What the catalog says, on main (1d86b6a03e10)
> || component || componentProperties || properties (endpoint) ||
> | camel-servlet | true | *false* |
> | camel-jetty | true | *false* |
> | camel-atmosphere-websocket | true | *false* |
> Every other owner of the option agrees with itself at {{true}}: coap, coaps,
> coap+tcp, coaps+tcp, cxf, grpc, knative, mina, netty-http, platform-http,
> undertow.
> h2. Not a disclosure
> Worth being explicit: this is a catalog-contract defect, not an exposure. The
> runtime default mutes the stack trace, and the published value is the *more*
> alarming one. The cost is that tooling (Kaoto, the VS Code extension, JBang
> completion) and the generated component docs tell a reader that a failed
> exchange returns the exception's stack trace by default on these three
> components, when it does not - which invites either redundant configuration
> or a security report about behaviour that is not there.
> Same shape as CAMEL-24891, where the damage was also the catalog contract
> rather than the runtime.
> h2. Fix
> Add {{defaultValue = "true"}} to the {{@UriParam}}, and set the field to
> {{true}} so the two agree on every path. The field change affects only an
> endpoint constructed without going through the component, which today gets
> {{false}}; making that {{true}} matches the documented default and is the
> safer of the two values.
> Regenerates the catalog and endpoint DSL for the three components, so it
> needs a full reactor.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
