[gnodet]

Backport of #27944

Cherry-pick of dad7b54 to camel-4.22.x.
Conflicts resolved automatically by backport bot agent.

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

[github-actions]

🧪 CI tested the following changed modules:

• components/camel-undertow
• docs

ℹ️ Dependent modules were not tested because the total number of affected modules exceeded the threshold (50). Use the test-dependents label to force testing all dependents.

---

🔬 Scalpel shadow comparison — Scalpel: 39 tested, 28 compile-only — current: 38 all tested

Maveniverse Scalpel detected 67 affected modules (current approach: 38).

⚠️ Modules only in Scalpel (29)

• apache-camel
• camel-allcomponents
• camel-catalog
• camel-catalog-console
• camel-catalog-lucene
• camel-catalog-maven
• camel-catalog-suggest
• camel-componentdsl
• camel-csimple-maven-plugin
• camel-endpointdsl
• camel-endpointdsl-support
• camel-itest
• camel-jbang-core
• camel-jbang-it
• camel-jbang-main
• camel-jbang-plugin-edit
• camel-jbang-plugin-generate
• camel-jbang-plugin-kubernetes
• camel-jbang-plugin-test
• camel-kamelet-main
• camel-launcher
• camel-report-maven-plugin
• camel-route-parser
• camel-yaml-dsl
• camel-yaml-dsl-deserializers
• camel-yaml-dsl-maven-plugin
• coverage
• docs
• dummy-component

Skip-tests mode would test 39 modules (2 direct + 37 downstream), skip tests for 28 (generated code, meta-modules)

Modules Scalpel would test (39)

• camel-a2a
• camel-consul
• camel-cxf-rest
• camel-cxf-soap
• camel-cxf-spring-rest
• camel-cxf-spring-soap
• camel-cxf-spring-transport
• camel-cxf-transport
• camel-jbang-mcp
• camel-jbang-plugin-mcp
• camel-jbang-plugin-route-parser
• camel-jbang-plugin-tui
• camel-jbang-plugin-validate
• camel-jsonpath
• camel-knative-http
• camel-launcher-container
• camel-lra
• camel-mcp-server
• camel-micrometer-observability
• camel-micrometer-prometheus
• camel-oauth
• camel-observability-services
• camel-openapi-validator
• camel-opentelemetry
• camel-opentelemetry2
• camel-platform-http-main
• camel-platform-http-vertx
• camel-rest-openapi
• camel-slack
• camel-soap
• camel-telemetry
• camel-telemetry-dev
• camel-undertow
• camel-undertow-spring-security
• camel-vertx-http
• camel-yaml-dsl-validator
• camel-yaml-dsl-validator-maven-plugin
• camel-zookeeper
• docs

Modules with tests skipped (28)

• apache-camel
• camel-allcomponents
• camel-catalog
• camel-catalog-console
• camel-catalog-lucene
• camel-catalog-maven
• camel-catalog-suggest
• camel-componentdsl
• camel-csimple-maven-plugin
• camel-endpointdsl
• camel-endpointdsl-support
• camel-itest
• camel-jbang-core
• camel-jbang-it
• camel-jbang-main
• camel-jbang-plugin-edit
• camel-jbang-plugin-generate
• camel-jbang-plugin-kubernetes
• camel-jbang-plugin-test
• camel-kamelet-main
• camel-launcher
• camel-report-maven-plugin
• camel-route-parser
• camel-yaml-dsl
• camel-yaml-dsl-deserializers
• camel-yaml-dsl-maven-plugin
• coverage
• dummy-component

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

Build reactor — dependencies compiled but only changed modules were tested (2 modules)

• Camel :: Docs
• Camel :: Undertow

---

⚙️ View full build and test results

[gnodet-bot]

LGTM. No issues found.

Clean security backport of #27944 to camel-4.22.x. The UndertowHelper.checkWriteable validation is correct per RFC 7230: rejects CR, LF, NUL, DEL, and chars above 0xFF (which Undertow would otherwise narrow to a different single byte), while correctly allowing SP, HTAB, and obs-text (0x80–0xFF). Exception propagation through both try-catch blocks in UndertowProducer is sound. Test coverage is thorough. Upgrade guide placed in the correct 4.22 document.

This review was generated by an AI agent, Hermès on behalf of @gnodet.

[davsclaus]

Thanks @gnodet. The code is a straight port of #27944: the changes to UndertowHelper, UndertowProducer, DefaultUndertowHttpBinding and UndertowProducerEncodedUriTest are identical to the main commit, and CI is green.

One thing about the upgrade guide note (inline): it is appended at the end of camel-4x-upgrade-guide-4_22.adoc, which puts it under "Upgrading Camel 4.21 to 4.22" instead of a new "Upgrading from 4.22.2 to 4.22.3" section. The project keeps the notes for maintenance releases in the guides on main (CLAUDE.md: "For backported changes, the upgrade guide entry must be added on the main branch"), as @oscerd does for the other camel-4.22.x ports this week (#28052, #28055). Could the doc change be dropped from this backport, and the note added to camel-4x-upgrade-guide-4_22.adoc on main under "Upgrading from 4.22.2 to 4.22.3" instead (or folded into #28052 / #28055, which already add that section)?

Claude Code on behalf of Claus Ibsen

[davsclaus]

This lands under "Upgrading Camel 4.21 to 4.22", the oldest section of the file. The note belongs under "Upgrading from 4.22.2 to 4.22.3", in the guide on main rather than on camel-4.22.x.