[backport camel-4.18.x] CAMEL-23373: camel-jms - Disable ObjectMessage by default

[oscerd]

Backport of #22866

Cherry-pick of #22866 onto camel-4.18.x.

Original PR: #22866 - CAMEL-23373: camel-jms - Disable ObjectMessage by default
Original author: @oscerd
Target branch: camel-4.18.x

Conflict resolution notes

The cherry-pick required a few manual resolutions because camel-4.18.x does not yet carry the security-options infrastructure introduced on main:

• Dropped the security = "insecure:serialization" attribute from @UriParam annotations on objectMessageEnabled, transferException, and transferExchange in JmsConfiguration — the security attribute does not exist on @UriParam / @Metadata in 4.18.x.
• Dropped the regenerated core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java — the SecurityUtils registry does not exist on 4.18.x.
• Stripped the "security": "insecure:serialization" JSON entries from the regenerated catalog and component descriptor JSON files for the same reason (they would otherwise carry a key the 4.18.x catalog format does not declare).
• Moved the upgrade-guide content from the (non-existent on 4.18.x) camel-4x-upgrade-guide-4_21.adoc into a new Upgrading from 4.18.2 to 4.18.3 section of camel-4x-upgrade-guide-4_18.adoc.

The functional behavior matches the original PR: objectMessageEnabled defaults to false, JmsBinding refuses to create or read jakarta.jms.ObjectMessage instances unless the option is enabled, all existing tests that rely on ObjectMessage opt in via setObjectMessageEnabled(true) (or ?objectMessageEnabled=true), and the new JmsObjectMessageEnabledTest covers default-disabled producer / consumer paths.

Sanity build

• mvn -pl :camel-jms -am -DskipTests=true install — green
• mvn -pl :camel-activemq,:camel-activemq6,:camel-amqp,:camel-catalog -am -DskipTests=true install — green

Original description

Summary

Resolves CAMEL-23373. Disables creation and reading of jakarta.jms.ObjectMessage by default in camel-jms and adds a new objectMessageEnabled option (default false) to opt back in at the component or endpoint level.

Java object serialization over JMS is rarely used in practice and is a recurring source of security advisories — the goal is to reduce the default attack surface and keep the feature available for users who explicitly need it.

Behavior

When objectMessageEnabled=false (the new default), JmsBinding refuses to:

• create an ObjectMessage from a Serializable body (auto-detected jmsMessageType=Object or explicitly set)
• create an ObjectMessage for transferExchange or transferException replies
• extract the body of a received ObjectMessage

In each case, IllegalStateException is thrown with a message pointing the user at how to enable the option:

JMS ObjectMessage is disabled by default for security reasons (...). Set objectMessageEnabled=true on the JMS endpoint or component to enable it.

To restore the previous behavior:

camel.component.jms.objectMessageEnabled=true

or per endpoint: jms:queue:foo?objectMessageEnabled=true.

🤖 Claude Code on behalf of Andrea Cosentino

[davsclaus]

btw there are (some) unit test fixes in itest that are related to this, that can be backported afterwards

commit 98926bb
Author: Claus Ibsen claus.ibsen@gmail.com
Date: Sat May 2 08:25:42 2026 +0200

CAMEL-23373: camel-jms - Disable ObjectMessage by default