CAMEL-24298: add an optional allowedSchemes allow-list to the toD dynamic-URI EIP

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/toD-eip.adoc

@@ -417,3 +417,42 @@ during startup if `toD` was optimized, or if there was a failure loading the opt
 ----
 Detected SendDynamicAware component: http optimising toD: http:myloginserver:8080/login?userid=${header.userName}
 ----
+
+== Restricting the allowed component schemes
+
+Because `toD` computes its endpoint uri at runtime, a route that interpolates message content into the uri
+(for example `toD("${header.target}")`) can end up resolving to any component on the classpath. In low-code or
+Kamelet-style deployments you may want to constrain this to a fixed set of components. The optional `allowedSchemes`
+option takes a comma-separated allow-list of component schemes; a resolved recipient whose scheme is not in the list
+is rejected (independently of `ignoreInvalidEndpoint`). By default the option is unset and any scheme is allowed.
+
+[source,java]
+----
+from("direct:start")
+    // only http and https recipients are permitted
+    .toD().allowedSchemes("http,https").uri("${header.target}");
+----
+
+And in XML:
+
+[source,xml]
+----
+<route>
+    <from uri="direct:start"/>
+    <toD uri="${header.target}" allowedSchemes="http,https"/>
+</route>
+----
+
+And in YAML:
+
+[source,yaml]
+----
+- from:
+    uri: direct:start
+    steps:
+      - toD:
+          uri: "${header.target}"
+          allowedSchemes: "http,https"
+----
+
+NOTE: `wireTap` extends `toD` and therefore honours the same `allowedSchemes` option.

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/models/toD.json

@@ -24,7 +24,8 @@
     "cacheSize": { "index": 8, "kind": "attribute", "displayName": "Cache Size", "group": "advanced", "label": "advanced", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "description": "Sets the maximum size used by the ProducerCache which is used to cache and reuse producers when uris are reused. Use 0 for default cache size, or -1 to turn cache off." },
     "ignoreInvalidEndpoint": { "index": 9, "kind": "attribute", "displayName": "Ignore Invalid Endpoint", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether to ignore invalid endpoint URIs and skip sending the message." },
     "allowOptimisedComponents": { "index": 10, "kind": "attribute", "displayName": "Allow Optimised Components", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether to allow components to optimise toD if they are SendDynamicAware." },
-    "autoStartComponents": { "index": 11, "kind": "attribute", "displayName": "Auto Start Components", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether to auto startup components when toD is starting up." }
+    "autoStartComponents": { "index": 11, "kind": "attribute", "displayName": "Auto Start Components", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether to auto startup components when toD is starting up." },
+    "allowedSchemes": { "index": 12, "kind": "attribute", "displayName": "Allowed Schemes", "group": "security", "label": "advanced,security", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Sets an optional comma-separated allow-list of component schemes that the dynamic recipient may resolve to (e.g. http,https). When set, a dynamic endpoint whose scheme is not in the list is rejected. This is a defence-in-depth restriction, useful for low-code \/ Kamelet deployments; by default (unset) any scheme is allowed." }
   },
   "exchangeProperties": {
     "CamelToEndpoint": { "index": 0, "kind": "exchangeProperty", "displayName": "To Endpoint", "label": "producer", "required": false, "javaType": "String", "deprecated": false, "autowired": false, "secret": false, "description": "Endpoint URI where this Exchange is being sent to" }

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/models/wireTap.json

@@ -27,7 +27,8 @@
     "cacheSize": { "index": 11, "kind": "attribute", "displayName": "Cache Size", "group": "advanced", "label": "advanced", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "description": "Sets the maximum size used by the ProducerCache which is used to cache and reuse producers when uris are reused. Use 0 for default cache size, or -1 to turn cache off." },
     "ignoreInvalidEndpoint": { "index": 12, "kind": "attribute", "displayName": "Ignore Invalid Endpoint", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether to ignore invalid endpoint URIs and skip sending the message." },
     "allowOptimisedComponents": { "index": 13, "kind": "attribute", "displayName": "Allow Optimised Components", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether to allow components to optimise toD if they are SendDynamicAware." },
-    "autoStartComponents": { "index": 14, "kind": "attribute", "displayName": "Auto Start Components", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether to auto startup components when toD is starting up." }
+    "autoStartComponents": { "index": 14, "kind": "attribute", "displayName": "Auto Start Components", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether to auto startup components when toD is starting up." },
+    "allowedSchemes": { "index": 15, "kind": "attribute", "displayName": "Allowed Schemes", "group": "security", "label": "advanced,security", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Sets an optional comma-separated allow-list of component schemes that the dynamic recipient may resolve to (e.g. http,https). When set, a dynamic endpoint whose scheme is not in the list is rejected. This is a defence-in-depth restriction, useful for low-code \/ Kamelet deployments; by default (unset) any scheme is allowed." }
   },
   "exchangeProperties": {
     "CamelToEndpoint": { "index": 0, "kind": "exchangeProperty", "displayName": "To Endpoint", "label": "producer", "required": false, "javaType": "String", "deprecated": false, "autowired": false, "secret": false, "description": "Endpoint URI where this Exchange is being sent to" }

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-spring.xsd

@@ -14006,6 +14006,17 @@ Whether to allow components to optimise toD if they are SendDynamicAware. Defaul
             <xs:documentation xml:lang="en">
 <![CDATA[
 Whether to auto startup components when toD is starting up. Default value: true
+]]>
+            </xs:documentation>
+          </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="allowedSchemes" type="xs:string">
+          <xs:annotation>
+            <xs:documentation xml:lang="en">
+<![CDATA[
+Sets an optional comma-separated allow-list of component schemes that the dynamic recipient may resolve to (e.g.
+http,https). When set, a dynamic endpoint whose scheme is not in the list is rejected. This is a defence-in-depth
+restriction, useful for low-code / Kamelet deployments; by default (unset) any scheme is allowed.
 ]]>
             </xs:documentation>
           </xs:annotation>

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-xml-io.xsd

@@ -13149,6 +13149,17 @@ Whether to allow components to optimise toD if they are SendDynamicAware. Defaul
             <xs:documentation xml:lang="en">
 <![CDATA[
 Whether to auto startup components when toD is starting up. Default value: true
+]]>
+            </xs:documentation>
+          </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="allowedSchemes" type="xs:string">
+          <xs:annotation>
+            <xs:documentation xml:lang="en">
+<![CDATA[
+Sets an optional comma-separated allow-list of component schemes that the dynamic recipient may resolve to (e.g.
+http,https). When set, a dynamic endpoint whose scheme is not in the list is rejected. This is a defence-in-depth
+restriction, useful for low-code / Kamelet deployments; by default (unset) any scheme is allowed.
 ]]>
             </xs:documentation>
           </xs:annotation>

core/camel-core-engine/src/main/docs/modules/eips/pages/toD-eip.adoc

@@ -417,3 +417,42 @@ during startup if `toD` was optimized, or if there was a failure loading the opt
 ----
 Detected SendDynamicAware component: http optimising toD: http:myloginserver:8080/login?userid=${header.userName}
 ----
+
+== Restricting the allowed component schemes
+
+Because `toD` computes its endpoint uri at runtime, a route that interpolates message content into the uri
+(for example `toD("${header.target}")`) can end up resolving to any component on the classpath. In low-code or
+Kamelet-style deployments you may want to constrain this to a fixed set of components. The optional `allowedSchemes`
+option takes a comma-separated allow-list of component schemes; a resolved recipient whose scheme is not in the list
+is rejected (independently of `ignoreInvalidEndpoint`). By default the option is unset and any scheme is allowed.
+
+[source,java]
+----
+from("direct:start")
+    // only http and https recipients are permitted
+    .toD().allowedSchemes("http,https").uri("${header.target}");
+----
+
+And in XML:
+
+[source,xml]
+----
+<route>
+    <from uri="direct:start"/>
+    <toD uri="${header.target}" allowedSchemes="http,https"/>
+</route>
+----
+
+And in YAML:
+
+[source,yaml]
+----
+- from:
+    uri: direct:start
+    steps:
+      - toD:
+          uri: "${header.target}"
+          allowedSchemes: "http,https"
+----
+
+NOTE: `wireTap` extends `toD` and therefore honours the same `allowedSchemes` option.

core/camel-core-model/src/generated/resources/META-INF/org/apache/camel/model/toD.json

@@ -24,7 +24,8 @@
     "cacheSize": { "index": 8, "kind": "attribute", "displayName": "Cache Size", "group": "advanced", "label": "advanced", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "description": "Sets the maximum size used by the ProducerCache which is used to cache and reuse producers when uris are reused. Use 0 for default cache size, or -1 to turn cache off." },
     "ignoreInvalidEndpoint": { "index": 9, "kind": "attribute", "displayName": "Ignore Invalid Endpoint", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether to ignore invalid endpoint URIs and skip sending the message." },
     "allowOptimisedComponents": { "index": 10, "kind": "attribute", "displayName": "Allow Optimised Components", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether to allow components to optimise toD if they are SendDynamicAware." },
-    "autoStartComponents": { "index": 11, "kind": "attribute", "displayName": "Auto Start Components", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether to auto startup components when toD is starting up." }
+    "autoStartComponents": { "index": 11, "kind": "attribute", "displayName": "Auto Start Components", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether to auto startup components when toD is starting up." },
+    "allowedSchemes": { "index": 12, "kind": "attribute", "displayName": "Allowed Schemes", "group": "security", "label": "advanced,security", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Sets an optional comma-separated allow-list of component schemes that the dynamic recipient may resolve to (e.g. http,https). When set, a dynamic endpoint whose scheme is not in the list is rejected. This is a defence-in-depth restriction, useful for low-code \/ Kamelet deployments; by default (unset) any scheme is allowed." }
   },
   "exchangeProperties": {
     "CamelToEndpoint": { "index": 0, "kind": "exchangeProperty", "displayName": "To Endpoint", "label": "producer", "required": false, "javaType": "String", "deprecated": false, "autowired": false, "secret": false, "description": "Endpoint URI where this Exchange is being sent to" }

core/camel-core-model/src/generated/resources/META-INF/org/apache/camel/model/wireTap.json

@@ -27,7 +27,8 @@
     "cacheSize": { "index": 11, "kind": "attribute", "displayName": "Cache Size", "group": "advanced", "label": "advanced", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "description": "Sets the maximum size used by the ProducerCache which is used to cache and reuse producers when uris are reused. Use 0 for default cache size, or -1 to turn cache off." },
     "ignoreInvalidEndpoint": { "index": 12, "kind": "attribute", "displayName": "Ignore Invalid Endpoint", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether to ignore invalid endpoint URIs and skip sending the message." },
     "allowOptimisedComponents": { "index": 13, "kind": "attribute", "displayName": "Allow Optimised Components", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether to allow components to optimise toD if they are SendDynamicAware." },
-    "autoStartComponents": { "index": 14, "kind": "attribute", "displayName": "Auto Start Components", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether to auto startup components when toD is starting up." }
+    "autoStartComponents": { "index": 14, "kind": "attribute", "displayName": "Auto Start Components", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether to auto startup components when toD is starting up." },
+    "allowedSchemes": { "index": 15, "kind": "attribute", "displayName": "Allowed Schemes", "group": "security", "label": "advanced,security", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Sets an optional comma-separated allow-list of component schemes that the dynamic recipient may resolve to (e.g. http,https). When set, a dynamic endpoint whose scheme is not in the list is rejected. This is a defence-in-depth restriction, useful for low-code \/ Kamelet deployments; by default (unset) any scheme is allowed." }
   },
   "exchangeProperties": {
     "CamelToEndpoint": { "index": 0, "kind": "exchangeProperty", "displayName": "To Endpoint", "label": "producer", "required": false, "javaType": "String", "deprecated": false, "autowired": false, "secret": false, "description": "Endpoint URI where this Exchange is being sent to" }

core/camel-core-model/src/main/java/org/apache/camel/model/ToDynamicDefinition.java

@@ -74,6 +74,13 @@ public class ToDynamicDefinition extends NoOutputDefinition<ToDynamicDefinition>
     @Metadata(label = "advanced", defaultValue = "true", javaType = "java.lang.Boolean",
               description = "Whether to auto startup components when toD is starting up.")
     private String autoStartComponents;
+    @XmlAttribute
+    @Metadata(label = "advanced,security",
+              description = "Sets an optional comma-separated allow-list of component schemes that the dynamic recipient"
+                            + " may resolve to (e.g. http,https). When set, a dynamic endpoint whose scheme is not in the"
+                            + " list is rejected. This is a defence-in-depth restriction, useful for low-code / Kamelet"
+                            + " deployments; by default (unset) any scheme is allowed.")
+    private String allowedSchemes;
 
     public ToDynamicDefinition() {
     }
@@ -93,6 +100,7 @@ protected ToDynamicDefinition(ToDynamicDefinition source) {
         this.ignoreInvalidEndpoint = source.ignoreInvalidEndpoint;
         this.allowOptimisedComponents = source.allowOptimisedComponents;
         this.autoStartComponents = source.autoStartComponents;
+        this.allowedSchemes = source.allowedSchemes;
     }
 
     @Override
@@ -264,6 +272,18 @@ public ToDynamicDefinition autoStartComponents(String autoStartComponents) {
         return this;
     }
 
+    /**
+     * Sets an optional comma-separated allow-list of component schemes that the dynamic recipient may resolve to (e.g.
+     * http,https). When set, a dynamic endpoint whose scheme is not in the list is rejected. By default (unset) any
+     * scheme is allowed.
+     *
+     * @return the builder
+     */
+    public ToDynamicDefinition allowedSchemes(String allowedSchemes) {
+        setAllowedSchemes(allowedSchemes);
+        return this;
+    }
+
     // Properties
     // -------------------------------------------------------------------------
 
@@ -339,6 +359,14 @@ public void setAutoStartComponents(String autoStartComponents) {
         this.autoStartComponents = autoStartComponents;
     }
 
+    public String getAllowedSchemes() {
+        return allowedSchemes;
+    }
+
+    public void setAllowedSchemes(String allowedSchemes) {
+        this.allowedSchemes = allowedSchemes;
+    }
+
     public ToDynamicDefinition copyDefinition() {
         return new ToDynamicDefinition(this);
     }