CAMEL-24158: Backport EventHubs HeaderFilterStrategy to 4.18.x

[davsclaus]

Summary

Claude Code on behalf of davsclaus

Backport of the EventHubs header filter strategy fix from PR #24884 to the camel-4.18.x maintenance branch (CVE-related).

Problem: EventHubsProducerOperations copies ALL Camel exchange headers (including internal Camel* headers) into AMQP application properties via eventData.getProperties().putAll(headers). This leaks Camel-internal headers to the Azure Event Hubs broker.

Fix:

• EventHubsComponent now extends HeaderFilterStrategyComponent instead of DefaultComponent, enabling the default DefaultHeaderFilterStrategy which filters out Camel* and org.apache.camel.* headers
• Producer passes the HeaderFilterStrategy to EventHubsProducerOperations, which applies it before putting headers on EventData
• Consumer only sets PARTITION_KEY header when the value is non-null (prevents null header from conflicting with PARTITION_ID on round-trip)

Test plan

• camel-azure-eventhubs module builds and compiles
• Generated files (configurer, JSON metadata) regenerated
• IT test constructor calls updated for new 3-arg signature
• CI green

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com

[gnodet]

Claude Code on behalf of gnodet

Review: APPROVE ✅

Clean backport of the EventHubs HeaderFilterStrategy fix from PR #24884 to camel-4.18.x. I reviewed the original PR in detail — this backport faithfully ports the same security fix.

Changes verified

1. EventHubsComponent — correctly extends HeaderFilterStrategyComponent instead of DefaultComponent, enabling default Camel* header filtering
2. EventHubsConsumer — null-guard on PARTITION_KEY header prevents null values from overriding PARTITION_ID on round-trip
3. EventHubsProducer → EventHubsProducerOperations — filter strategy is obtained from the component and threaded through to the operations layer
4. EventHubsProducerOperations — headers are now individually filtered via applyFilterToCamelHeaders() before being placed on EventData properties, preventing internal Camel*/org.apache.camel.* headers from leaking to the AMQP broker
5. Generated files — configurer and JSON metadata properly regenerated with the new headerFilterStrategy property at index 19
6. IT tests — constructor calls updated for the new 3-arg signature (passing null since ITs don't need header filtering)

Minor bonus: the backport also modernizes instanceof checks to use pattern matching (data instanceof Exchange ex), which is fine for 4.18.x (Java 17+).

The security fix is correct and the backport is clean.

---

🤖 This review was generated by an AI agent (Claude Code) on behalf of gnodet. AI-generated reviews are advisory — human judgment should guide final decisions.

[gnodet]

Claude Code on behalf of gnodet

Follow-up review — rebased commit (ea14d7e) ✅

The PR was rebased to include proper catalog and component DSL regeneration:

• azure-eventhubs.json catalog — headerFilterStrategy property added at index 19
• AzureEventhubsComponentBuilderFactory.java — DSL builder method and setPropertyOnComponent case added

Source code is unchanged from the original review. These generated files complete the backport properly. Approval still stands.

---

🤖 This review was generated by an AI agent (Claude Code) on behalf of gnodet. AI-generated reviews are advisory — human judgment should guide final decisions.