Repository navigation
[backport camel-4.18.x] CAMEL-25704: camel-undertow - refuse a request target or header value with control characters - #28064
Conversation
…t target or header value with control characters
gnodet
added
the
backport
gnodet-bot
left a comment
gnodet-bot
left a comment
There was a problem hiding this comment.
Solid security fix, correctly backported. The checkWriteable validation is well-reasoned: addresses both direct CR/LF injection and byte-narrowing attack (chars above 0xFF). Error handling properly catches IllegalArgumentException from both request-target and header validation paths and fails the exchange synchronously. Test coverage thorough. Identical to merged #27944 on main.
This review was generated by an AI agent, Hermès on behalf of @gnodet.
davsclaus
left a comment
davsclaus
left a comment
There was a problem hiding this comment.
Thanks @gnodet. The code is a straight port of #27944: the changes to UndertowHelper, UndertowProducer, DefaultUndertowHttpBinding and UndertowProducerEncodedUriTest are identical to the main commit, and CI is green.
One thing about the upgrade guide note (inline): it is appended at the end of camel-4x-upgrade-guide-4_18.adoc, which puts it under "Upgrading Camel 4.17 to 4.18" instead of a new "Upgrading from 4.18.5 to 4.18.6" section. The project keeps the notes for maintenance releases in the guides on main (CLAUDE.md: "For backported changes, the upgrade guide entry must be added on the main branch"), as @oscerd does for the other camel-4.18.x ports this week (#28052, #28055). Could the doc change be dropped from this backport, and the note added to camel-4x-upgrade-guide-4_18.adoc on main under "Upgrading from 4.18.5 to 4.18.6" instead (or folded into #28052 / #28055, which already add that section)?
Claude Code on behalf of Claus Ibsen
| at WARN the first time and at DEBUG on later polls; this log-level change also applies to the remote file consumers, | ||
| which keep their existing lexical check. | ||
|
|
||
| === camel-undertow - the producer refuses a request target or header value with control characters |
There was a problem hiding this comment.
This lands under "Upgrading Camel 4.17 to 4.18", the oldest section of the file. The note belongs under "Upgrading from 4.18.5 to 4.18.6", in the guide on main rather than on camel-4.18.x.
Backport of #27944
Cherry-pick of dad7b54 to camel-4.18.x.
Conflicts resolved automatically by backport bot agent.