allowContextMapAll requires template engines to have reflective access to camel core classess

[jamesnetherton]

Thinking a bit more about this comment.

We probably have a general issue with all of the templating component extensions (qute, mustache, mvel, velocity etc) where the template engine may need reflective access to complex objects like Exchange, Message or CamelContext. E.g as described here when allowContextMapAll is enabled.

I don't think we have much (or any) test coverage for this, so we haven't noticed any issues thus far.

We could:

• Add a general purpose support extension, that would contain a BuildStep to configure reflection for these classes. Then the various extensions could depend on it.

• Not offer any OOTB support for allowContextMapAll in native mode, and advise folks to keep things simple by only referencing the message body, headers & properties in templates

• Similar to the above but force users to manually do the reflective class configuration for the necessary bits.

[davsclaus]

allowContextMapAll is a security vulnerabilty fix, so I am fine with no support for setting = true in camel-quarkus native mode or even jvm mode