Skip to content

Fix unregistered and hijacked external links in documentation - #25717

Merged
oscerd merged 2 commits into
apache:mainfrom
ppkarwasz:fix/citrus-framework-link-typo
Aug 25, 2026
Merged

Fix unregistered and hijacked external links in documentation#25717
oscerd merged 2 commits into
apache:mainfrom
ppkarwasz:fix/citrus-framework-link-typo

Conversation

@ppkarwasz

@ppkarwasz ppkarwasz commented Aug 25, 2026

Copy link
Copy Markdown
Member

What

Fixes two external documentation links that point at domains not controlled by the projects they claim to reference:

  1. Citrus link typodocs/user-manual/modules/ROOT/pages/testing.adoc linked to citfrusframework.org instead of citrusframework.org. The misspelled domain is unregistered (verified via RDAP on 2026-08-25), so anyone could register it and serve arbitrary content to readers — and to AI agents that consume the generated https://camel.apache.org/manual/testing.md / llms.txt files — under the authority of the Camel documentation. Introduced in 67a4e62 (chore(docs): Improve integration testing documentation #18883); reported to security@apache.org by an external researcher and triaged as a documentation fix rather than a vulnerability.

  2. Hijacked snakeyaml.org — the SnakeYAML docs and Javadoc linked to www.snakeyaml.org, but that domain lapsed and was re-registered on 2025-01-01 by an unrelated third party that now serves an SEO content site trading on the SnakeYAML name. The links now point to the project's real home at https://bitbucket.org/snakeyaml/snakeyaml. The catalog copy of the doc page (a verbatim sync of the source .adoc) was updated to match.

Verification sweep

All ~400 external domains referenced across the documentation tree were checked for: look-alike misspellings (edit-distance comparison), unregistered domains (DNS + RDAP), nameservers pointing at domain-parking services, RDAP re-registration dates newer than the doc references, and "for sale" landing pages. No other compromised or claimable real-project domain was found. Notes for potential follow-ups (not security-relevant, so left out of this PR): kaotoio.github.io/kaoto/ in getting-started.adoc is a dead GitHub Pages link (the KaotoIO org still exists, so it is not takeover-able), and random-data-api.com (used in JBang examples) no longer serves DNS but remains registered until 2027.


This PR was created by Claude Code on behalf of ppkarwasz.

🤖 Generated with Claude Code

https://claude.ai/code/session_015JZf5SuQcZsKEyX9MRWMbh

The link pointed to citfrusframework.org (a typo of citrusframework.org)
which is an unregistered domain and therefore claimable by anyone.

Assisted-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015JZf5SuQcZsKEyX9MRWMbh
@github-actions

Copy link
Copy Markdown
Contributor

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

  • First-time contributors require MANUAL approval for the GitHub Actions to run
  • You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
  • You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
  • Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

@github-actions github-actions Bot added the docs label Aug 25, 2026
The snakeyaml.org domain lapsed and was re-registered on 2025-01-01 by an
unrelated third party that now serves an SEO content site trading on the
SnakeYAML name. Point the documentation and Javadoc at the project's real
home on Bitbucket instead.

Assisted-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015JZf5SuQcZsKEyX9MRWMbh
@ppkarwasz ppkarwasz changed the title Fix broken Citrus framework link in testing documentation Fix unregistered and hijacked external links in documentation Aug 25, 2026
@oscerd
oscerd merged commit 62e3585 into apache:main Aug 25, 2026
4 of 6 checks passed
@ppkarwasz
ppkarwasz deleted the fix/citrus-framework-link-typo branch August 25, 2026 14:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants