CAMEL-24085: Apply header filter strategy to IronMQ message envelope headers#24828
Conversation
…headers The IronMQ consumer deserializes a JSON envelope (a headers map and a body) and copied the embedded header entries onto the Camel message without applying a HeaderFilterStrategy. Route the envelope headers through a HeaderFilterStrategy so Camel* headers (matched case-insensitively) present in the sender-controlled envelope are filtered, consistent with the inbound header filtering performed by other consumers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
|
🌟 Thank you for your contribution to the Apache Camel project! 🌟 🐫 Apache Camel Committers, please review the following items:
|
gnodet
left a comment
gnodet
left a comment
There was a problem hiding this comment.
Claude Code on behalf of gnodet
LGTM — security fix for header injection via IronMQ message envelope.
This is exactly the kind of consumer-side header filtering gap the project's security model flags (untrusted input mapped into the Exchange header map without a HeaderFilterStrategy). The fix is consistent with the CloudEvent structured-mode fix in CAMEL-24084 (#24724).
Review notes:
-
Correct pattern —
DefaultHeaderFilterStrategyfiltersCamel*headers case-insensitively by default, matching the standard inbound filtering behavior of other consumers. The!applyFilterToExternalHeaders()negation correctly blocks filtered headers. -
Thread-safe —
DefaultHeaderFilterStrategyis stateless, so theprivate static finalinstance is safe for concurrent use across consumer threads. -
Existing-header precedence preserved — the
target.getHeader(key) == nullcheck remains, so component-set headers (likeMESSAGE_ID) aren't overwritten by envelope data. -
Test — crafts a realistic attack payload with both
CamelFileName(Pascal-case) andcamelExecCommandExecutable(camel-case) injected headers. Verifies legitimate headers propagate whileCamel*entries are filtered. Good case-insensitivity coverage. -
Upgrade guide — clear migration note following the same structure as the CloudEvent entry. Appropriate given the behavioral change for
preserveHeaders=trueconsumers. -
Backport note — good call flagging the 4.18.x/4.14.x applicability with the
setInFilterStartsWithvariant needed for pre-CAMEL-23543 branches.
Minor: the component is deprecated since 4.21 but this fix is still worthwhile since it ships in 4.22 and the maintenance branches.
|
🧪 CI tested the following changed modules:
🔬 Scalpel shadow comparison — Scalpel: 10 tested, 28 compile-only — current: 9 all testedMaveniverse Scalpel detected 38 affected modules (current approach: 9).
|
3 participants
Motivation
When receiving a message with
preserveHeaders=true, the IronMQ consumer deserializes a JSON envelope (a headers map and a body) and copies the embedded header entries onto the Camel message (GsonUtil.copyFrom, called fromIronMQConsumer) without applying aHeaderFilterStrategy. The envelope is fully sender-controlled, so a sender can inject Camel-internal control headers (theCamel*namespace) onto the exchange.Changes
GsonUtil.copyFromnow routes the embedded envelope headers through aDefaultHeaderFilterStrategy(applyFilterToExternalHeaders), soCamel*headers (matched case-insensitively) are no longer mapped onto the Camel message — consistent with the inbound header filtering performed by other consumers, and with the same approach as the structured-mode CloudEvent fix in CAMEL-24084 (CAMEL-24084: Apply header filter strategy to structured-mode CloudEvent extension headers #24724).IronMQConsumerHeaderFilterTestpushing a crafted envelope through the existingMockQueue: ordinary headers still propagate,Camel*entries are filtered.camel-4x-upgrade-guide-4_22.adoc.Note: camel-ironmq is deprecated since 4.21, but still ships; the same envelope mapping exists on the 4.18.x/4.14.x maintenance branches, so this is a backport candidate (those branches need the explicit
setInFilterStartsWithvariant, pre-CAMEL-23543).Testing
mvn clean installincomponents/camel-ironmq: all tests pass (new test + existing preserve-headers round-trip).mvn clean install -DskipTestsfrom root: success, no stale generated files.Claude Code on behalf of Andrea Cosentino (@oscerd).
🤖 Generated with Claude Code