CAMEL-24297: make ldif URL-body dereferencing an explicit opt-in - #25310
Merged
Conversation
The ldif producer treated a message body that does not start with "version: 1" as a URL and dereferenced it (URI.create(body).toURL().openStream()). This content-sniffed URL fetch is now gated by a new allowUrlBody option (default false, tagged security="insecure:dev"). With the default a non-LDIF body is rejected with an IllegalArgumentException instead of being fetched, avoiding a content-sniffed URL fetch (SSRF) from untrusted body content. Routes that rely on passing a URL as the body must set allowUrlBody=true. Adds a unit test for the default rejection, enables the option on the existing LdifRouteIT (which feeds URLs as the body), and documents the change in the upgrade guide. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
gnodet
approved these changes
Aug 3, 2026
gnodet
left a comment
gnodet
left a comment
Contributor
There was a problem hiding this comment.
🤖 AI-assisted review — Claude Code on behalf of @gnodet
Review: CAMEL-24297 — make LDIF URL-body dereferencing an explicit opt-in
Clean security hardening. The previous behavior implicitly treated non-LDIF message bodies as URLs and dereferenced them via URI.create(body).toURL().openStream() — an SSRF risk. This PR gates that behind allowUrlBody (default false), requiring explicit opt-in.
What's done well:
- Default is secure:
allowUrlBody = falserejects non-LDIF bodies withIllegalArgumentException @UriParamcorrectly annotated withsecurity = "insecure:dev"andlabel = "security"SecurityUtils.javamap entry properly added- Upgrade guide documents the breaking change with clear migration path
- Error message mentions the
allowUrlBodyoption name for debuggability - Existing
LdifRouteITupdated to set?allowUrlBody=true - New test class is package-private with package-private methods (JUnit 5 convention)
- All generated files consistent with source changes
One minor observation: The new LdifAllowUrlBodyTest uses JUnit assertions (assertThrows, assertInstanceOf, assertTrue). Per project convention, AssertJ (assertThatThrownBy) is preferred for new test code — but this is non-blocking.
LGTM 👍
davsclaus
approved these changes
Aug 3, 2026
# Conflicts: # docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
Contributor
|
🌟 Thank you for your contribution to the Apache Camel project! 🌟 🐫 Apache Camel Committers, please review the following items:
|
Contributor
|
🧪 CI tested the following changed modules:
🔬 Scalpel shadow comparison — Scalpel: 564 tested, 26 compile-only — current: 561 all testedMaveniverse Scalpel detected 590 affected modules (current approach: 561).
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The ldif producer treated a message body that does not start with
version: 1as a URL and dereferenced it (URI.create(body).toURL().openStream()). This content-sniffed mode switch was implicit. It is now gated by a newallowUrlBodyoption (defaultfalse, taggedsecurity="insecure:dev").Behaviour (breaking)
With the default (
allowUrlBody=false), a non-LDIF body is rejected with anIllegalArgumentExceptioninstead of being dereferenced as a URL — avoiding a content-sniffed URL fetch (SSRF) from untrusted body content. Routes that intentionally pass a URL as the body must now setallowUrlBody=trueon theldifendpoint. Documented in the upgrade guide.Tests
LdifAllowUrlBodyTestasserts a non-LDIF body is rejected by default (no LDAP server needed — the rejection happens before the LDAP connection is used).LdifRouteIT(which feeds resource URLs as the body) now setsallowUrlBody=true.Full-reactor
mvn clean install -DskipTestsis green (catalog/docs/DSL + theSecurityUtilsinsecure:devmap entry regenerated).Backport
main only — this changes a default to be more restrictive (breaking), so it is not backported to the maintenance branches.
Closes CAMEL-24297.
Claude Code on behalf of Andrea Cosentino (@oscerd)