CAMEL-24578: Configure Avro ClassSecurityValidator at runtime for camel-avro-rpc

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/avro.json

@@ -33,7 +33,8 @@
     "bridgeErrorHandler": { "index": 6, "kind": "property", "displayName": "Bridge Error Handler", "group": "consumer", "label": "consumer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Allows for bridging the consumer to the Camel routing Error Handler, which mean any exceptions (if possible) occurred while the Camel consumer is trying to pickup incoming messages, or the likes, will now be processed as a message and handled by the routing Error Handler. Important: This is only possible if the 3rd party component allows Camel to be alerted if an exception was thrown. Some components handle this internally only, and therefore bridgeErrorHandler is not possible. In other situations we may improve the Camel component to hook into the 3rd party component and make this possible for future releases. By default the consumer will use the org.apache.camel.spi.ExceptionHandler to deal with exceptions, that will be logged at WARN or ERROR level and ignored." },
     "lazyStartProducer": { "index": 7, "kind": "property", "displayName": "Lazy Start Producer", "group": "producer", "label": "producer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing." },
     "autowiredEnabled": { "index": 8, "kind": "property", "displayName": "Autowired Enabled", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc." },
-    "configuration": { "index": 9, "kind": "property", "displayName": "Configuration", "group": "advanced", "label": "advanced", "required": false, "type": "object", "javaType": "org.apache.camel.component.avro.AvroConfiguration", "deprecated": false, "autowired": false, "secret": false, "description": "To use a shared AvroConfiguration to configure options once" }
+    "configuration": { "index": 9, "kind": "property", "displayName": "Configuration", "group": "advanced", "label": "advanced", "required": false, "type": "object", "javaType": "org.apache.camel.component.avro.AvroConfiguration", "deprecated": false, "autowired": false, "secret": false, "description": "To use a shared AvroConfiguration to configure options once" },
+    "serializablePackages": { "index": 10, "kind": "property", "displayName": "Serializable Packages", "group": "security", "label": "security", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "security": "insecure:serialization", "configurationClass": "org.apache.camel.component.avro.AvroConfiguration", "configurationField": "configuration", "description": "Comma-separated list of additional packages that contain trusted Avro model classes. Avro 1.12 validates classes resolved from schemas; Camel automatically trusts org.apache.avro for IPC and packages derived from the configured protocol. Use this option for any additional model packages not inferred from the protocol." }
   },
   "headers": {
     "CamelAvroMessageName": { "index": 0, "kind": "header", "displayName": "", "group": "common", "label": "", "required": false, "javaType": "String", "deprecated": false, "deprecationNote": "", "autowired": false, "secret": false, "description": "The name of the message to send. In consumer overrides message name from URI (if any)", "constantName": "org.apache.camel.component.avro.AvroConstants#AVRO_MESSAGE_NAME" }
@@ -52,6 +53,7 @@
     "bridgeErrorHandler": { "index": 10, "kind": "parameter", "displayName": "Bridge Error Handler", "group": "consumer (advanced)", "label": "consumer,advanced", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Allows for bridging the consumer to the Camel routing Error Handler, which mean any exceptions (if possible) occurred while the Camel consumer is trying to pickup incoming messages, or the likes, will now be processed as a message and handled by the routing Error Handler. Important: This is only possible if the 3rd party component allows Camel to be alerted if an exception was thrown. Some components handle this internally only, and therefore bridgeErrorHandler is not possible. In other situations we may improve the Camel component to hook into the 3rd party component and make this possible for future releases. By default the consumer will use the org.apache.camel.spi.ExceptionHandler to deal with exceptions, that will be logged at WARN or ERROR level and ignored." },
     "exceptionHandler": { "index": 11, "kind": "parameter", "displayName": "Exception Handler", "group": "consumer (advanced)", "label": "consumer,advanced", "required": false, "type": "object", "javaType": "org.apache.camel.spi.ExceptionHandler", "optionalPrefix": "consumer.", "deprecated": false, "autowired": false, "secret": false, "description": "To let the consumer use a custom ExceptionHandler. Notice if the option bridgeErrorHandler is enabled then this option is not in use. By default the consumer will deal with exceptions, that will be logged at WARN or ERROR level and ignored." },
     "exchangePattern": { "index": 12, "kind": "parameter", "displayName": "Exchange Pattern", "group": "consumer (advanced)", "label": "consumer,advanced", "required": false, "type": "enum", "javaType": "org.apache.camel.ExchangePattern", "enum": [ "InOnly", "InOut" ], "deprecated": false, "autowired": false, "secret": false, "description": "Sets the exchange pattern when the consumer creates an exchange." },
-    "lazyStartProducer": { "index": 13, "kind": "parameter", "displayName": "Lazy Start Producer", "group": "producer (advanced)", "label": "producer,advanced", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing." }
+    "lazyStartProducer": { "index": 13, "kind": "parameter", "displayName": "Lazy Start Producer", "group": "producer (advanced)", "label": "producer,advanced", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing." },
+    "serializablePackages": { "index": 14, "kind": "parameter", "displayName": "Serializable Packages", "group": "security", "label": "security", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "security": "insecure:serialization", "configurationClass": "org.apache.camel.component.avro.AvroConfiguration", "configurationField": "configuration", "description": "Comma-separated list of additional packages that contain trusted Avro model classes. Avro 1.12 validates classes resolved from schemas; Camel automatically trusts org.apache.avro for IPC and packages derived from the configured protocol. Use this option for any additional model packages not inferred from the protocol." }
   }
 }

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/avro.json

@@ -17,6 +17,7 @@
   },
   "properties": {
     "id": { "index": 0, "kind": "attribute", "displayName": "Id", "group": "common", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "The id of this node" },
-    "instanceClassName": { "index": 1, "kind": "attribute", "displayName": "Instance Class Name", "group": "common", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Class name to use for marshal and unmarshalling." }
+    "instanceClassName": { "index": 1, "kind": "attribute", "displayName": "Instance Class Name", "group": "common", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Class name to use for marshal and unmarshalling." },
+    "serializablePackages": { "index": 2, "kind": "attribute", "displayName": "Serializable Packages", "group": "security", "label": "security", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Comma-separated list of additional packages that contain trusted Avro model classes. Avro 1.12 validates classes resolved from schemas; Camel automatically trusts packages derived from the configured schema or instance class." }
   }
 }

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/models/avro.json

@@ -33,6 +33,7 @@
     "autoDiscoverObjectMapper": { "index": 17, "kind": "attribute", "displayName": "Auto Discover Object Mapper", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "If set to true then Jackson will lookup for an objectMapper into the registry." },
     "contentTypeHeader": { "index": 18, "kind": "attribute", "displayName": "Content Type Header", "group": "common", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether the data format should set the Content-Type header with the type from the data format. For example application\/xml for data formats marshalling to XML, or application\/json for data formats marshalling to JSON" },
     "schemaResolver": { "index": 19, "kind": "attribute", "displayName": "Schema Resolver", "group": "advanced", "label": "advanced", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Optional schema resolver used to lookup schemas for the data in transit." },
-    "autoDiscoverSchemaResolver": { "index": 20, "kind": "attribute", "displayName": "Auto Discover Schema Resolver", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "When not disabled, the SchemaResolver will be looked up into the registry." }
+    "autoDiscoverSchemaResolver": { "index": 20, "kind": "attribute", "displayName": "Auto Discover Schema Resolver", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "When not disabled, the SchemaResolver will be looked up into the registry." },
+    "serializablePackages": { "index": 21, "kind": "attribute", "displayName": "Serializable Packages", "group": "security", "label": "security", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Comma-separated list of additional packages that contain trusted Avro model classes. Avro 1.12 validates classes resolved from schemas; Camel automatically trusts packages derived from the configured schema or instance class." }
   }
 }

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-spring.xsd

@@ -7543,6 +7543,16 @@ Optional schema resolver used to lookup schemas for the data in transit.
             <xs:documentation xml:lang="en">
 <![CDATA[
 When not disabled, the SchemaResolver will be looked up into the registry. Default value: true
+]]>
+            </xs:documentation>
+          </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="serializablePackages" type="xs:string">
+          <xs:annotation>
+            <xs:documentation xml:lang="en">
+<![CDATA[
+Comma-separated list of additional packages that contain trusted Avro model classes. Avro 1.12 validates classes
+resolved from schemas; Camel automatically trusts packages derived from the configured schema or instance class.
 ]]>
             </xs:documentation>
           </xs:annotation>

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-xml-io.xsd

@@ -6665,6 +6665,16 @@ Optional schema resolver used to lookup schemas for the data in transit.
             <xs:documentation xml:lang="en">
 <![CDATA[
 When not disabled, the SchemaResolver will be looked up into the registry. Default value: true
+]]>
+            </xs:documentation>
+          </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="serializablePackages" type="xs:string">
+          <xs:annotation>
+            <xs:documentation xml:lang="en">
+<![CDATA[
+Comma-separated list of additional packages that contain trusted Avro model classes. Avro 1.12 validates classes
+resolved from schemas; Camel automatically trusts packages derived from the configured schema or instance class.
 ]]>
             </xs:documentation>
           </xs:annotation>

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camelYamlDsl-model.json

@@ -10438,6 +10438,16 @@
         "index" : 20,
         "group" : "advanced",
         "label" : "advanced"
+      }, {
+        "name" : "serializablePackages",
+        "type" : "string",
+        "description" : "Comma-separated list of additional packages that contain trusted Avro model classes. Avro 1.12 validates classes resolved from schemas; Camel automatically trusts packages derived from the configured schema or instance class.",
+        "title" : "Serializable Packages",
+        "displayName" : "Serializable Packages",
+        "kind" : "attribute",
+        "index" : 21,
+        "group" : "security",
+        "label" : "security"
       } ]
     },
     "barcode" : {

components/camel-avro-rpc/camel-avro-rpc-component/pom.xml

@@ -31,16 +31,15 @@
     <name>Camel :: Avro RPC</name>
     <description>Camel Avro  RPC component</description>
 
-    <properties>
-        <!-- Avro 1.12.2 requires the IPC and test protocol model packages to be explicitly trusted. -->
-        <camel.surefire.fork.additional-vmargs>-Dorg.apache.avro.SERIALIZABLE_PACKAGES=org.apache.avro,org.apache.camel.avro</camel.surefire.fork.additional-vmargs>
-    </properties>
-
     <dependencies>
         <dependency>
             <groupId>org.apache.camel</groupId>
             <artifactId>camel-support</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.apache.camel</groupId>
+            <artifactId>camel-avro</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.apache.avro</groupId>
             <artifactId>avro</artifactId>

components/camel-avro-rpc/camel-avro-rpc-component/src/generated/java/org/apache/camel/component/avro/AvroComponentConfigurer.java

@@ -44,6 +44,8 @@ public boolean configure(CamelContext camelContext, Object obj, String name, Obj
         case "protocolLocation": getOrCreateConfiguration(target).setProtocolLocation(property(camelContext, java.lang.String.class, value)); return true;
         case "reflectionprotocol":
         case "reflectionProtocol": getOrCreateConfiguration(target).setReflectionProtocol(property(camelContext, boolean.class, value)); return true;
+        case "serializablepackages":
+        case "serializablePackages": getOrCreateConfiguration(target).setSerializablePackages(property(camelContext, java.lang.String.class, value)); return true;
         case "singleparameter":
         case "singleParameter": getOrCreateConfiguration(target).setSingleParameter(property(camelContext, boolean.class, value)); return true;
         case "uriauthority":
@@ -69,6 +71,8 @@ public Class<?> getOptionType(String name, boolean ignoreCase) {
         case "protocolLocation": return java.lang.String.class;
         case "reflectionprotocol":
         case "reflectionProtocol": return boolean.class;
+        case "serializablepackages":
+        case "serializablePackages": return java.lang.String.class;
         case "singleparameter":
         case "singleParameter": return boolean.class;
         case "uriauthority":
@@ -95,6 +99,8 @@ public Object getOptionValue(Object obj, String name, boolean ignoreCase) {
         case "protocolLocation": return getOrCreateConfiguration(target).getProtocolLocation();
         case "reflectionprotocol":
         case "reflectionProtocol": return getOrCreateConfiguration(target).isReflectionProtocol();
+        case "serializablepackages":
+        case "serializablePackages": return getOrCreateConfiguration(target).getSerializablePackages();
         case "singleparameter":
         case "singleParameter": return getOrCreateConfiguration(target).isSingleParameter();
         case "uriauthority":

components/camel-avro-rpc/camel-avro-rpc-component/src/generated/java/org/apache/camel/component/avro/AvroEndpointConfigurer.java

@@ -38,6 +38,8 @@ public boolean configure(CamelContext camelContext, Object obj, String name, Obj
         case "protocolLocation": target.getConfiguration().setProtocolLocation(property(camelContext, java.lang.String.class, value)); return true;
         case "reflectionprotocol":
         case "reflectionProtocol": target.getConfiguration().setReflectionProtocol(property(camelContext, boolean.class, value)); return true;
+        case "serializablepackages":
+        case "serializablePackages": target.getConfiguration().setSerializablePackages(property(camelContext, java.lang.String.class, value)); return true;
         case "singleparameter":
         case "singleParameter": target.getConfiguration().setSingleParameter(property(camelContext, boolean.class, value)); return true;
         case "uriauthority":
@@ -64,6 +66,8 @@ public Class<?> getOptionType(String name, boolean ignoreCase) {
         case "protocolLocation": return java.lang.String.class;
         case "reflectionprotocol":
         case "reflectionProtocol": return boolean.class;
+        case "serializablepackages":
+        case "serializablePackages": return java.lang.String.class;
         case "singleparameter":
         case "singleParameter": return boolean.class;
         case "uriauthority":
@@ -91,6 +95,8 @@ public Object getOptionValue(Object obj, String name, boolean ignoreCase) {
         case "protocolLocation": return target.getConfiguration().getProtocolLocation();
         case "reflectionprotocol":
         case "reflectionProtocol": return target.getConfiguration().isReflectionProtocol();
+        case "serializablepackages":
+        case "serializablePackages": return target.getConfiguration().getSerializablePackages();
         case "singleparameter":
         case "singleParameter": return target.getConfiguration().isSingleParameter();
         case "uriauthority":