[backport camel-4.18.x] CAMEL-24574: camel-google-bigquery - document ${name} substitution and warn on non-identifier values - #26015
Merged
Conversation
…titution and warn when it is not an identifier The google-bigquery-sql endpoint accepts two placeholder forms that behave differently: @name is bound as a named BigQuery query parameter, while ${name} is spliced as literal text into the query before it is sent (needed because BigQuery parameters can bind values but not identifiers). The docs only described the ${name} form and didn't convey this split, so a reader could reasonably use ${name} for values -- a SQL injection risk if that value comes from untrusted input. Adds a "Query Placeholders" doc section contrasting the two forms and warning that ${name} must never be populated from untrusted message content. SqlHelper.translateQuery now logs a WARN (name only, never the value) when a ${name} substitution doesn't look like a BigQuery identifier. No behavior change to the substitution itself. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Closes apache#26007 (cherry picked from commit e143e48)
gnodet
approved these changes
Sep 1, 2026
gnodet
left a comment
Contributor
There was a problem hiding this comment.
Straight cherry-pick backport of #26007 to camel-4.18.x. Source-file diffs are identical to the original (only context line-numbers and pre-existing AsciiDoc delimiter style differ between branches). The missing catalog/ generated file is expected — that mirror doesn't exist on camel-4.18.x. Approving without fresh review per backport policy.
This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.
Claude Code on behalf of Guillaume Nodet
davsclaus
approved these changes
Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #26007 to
camel-4.18.x.This one is not a straight cherry-pick — it needed manual conflict resolution, so it is not claiming the backport review exemption. The Java is a mechanical port; the documentation needed adapting to this branch. Details below.
What it does
The
google-bigquery-sqlendpoint accepts two placeholder forms that behave differently:@nameis bound as a BigQuery named query parameter, while${name}is spliced into the query text verbatim. Both are needed, because BigQuery named parameters can bind values but cannot bind identifiers, so a dataset or table name can only be supplied through${name}.The documentation described
${name}only as "extracted from message headers and formed the translated query", which does not convey that the substitution is literal text rather than parameter binding, and gave no guidance to use@namefor values.This adds a
Query Placeholderssection documenting the split, and reports at WARN level when a${name}substitution does not have the shape of a BigQuery identifier. Only the placeholder name is logged, never the substituted value.The substitution behaviour itself is unchanged, so no upgrade-guide entry is needed (and per project convention upgrade guides live on
mainregardless).Divergences from the
maincommitcatalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/google-bigquery-sql-component.adocdoes not exist oncamel-4.18.x— this branch carries 1 file under that directory versus 702 oncamel-4.22.x, so the per-component catalog doc mirror is not maintained here. Adding it would introduce a file the branch does not otherwise ship.----). The cherry-pick would have introduced three----fences; they were converted so the file stays internally consistent. Purely cosmetic — both forms are valid AsciiDoc.All three Java files are byte-identical to
main. Verified by direct comparison againstorigin/main:SqlHelper.java,SqlHelperIdentifierTest.java,SqlHelperTest.java. No behavioural difference from the change reviewed on #26007.Verification
----fences remaining.Claude Code on behalf of oscerd