[backport camel-spring-boot-4.22.x] CAMEL-24503: camel-spring-boot - see camel properties supplied as environment variables - #1961
Merged
Croway merged 1 commit intoSep 9, 2026
Conversation
…ironment variables extractCamelProperties filtered on the property name exactly as its source reports it. The systemEnvironment source reports environment variables in their native CAMEL_COMPONENT_FOO_BAR form, which never matches the "camel." prefix, so any Camel option configured through the environment was invisible to the camel.security policy check added in CAMEL-23250 - even though Spring's relaxed binding applies it to the component regardless. That is the usual way to configure a containerised application, so the check was blind to a large part of real deployments. Names are now canonicalized with ConfigurationPropertyName.adapt before the prefix test, and the canonical name is used for the lookup so relaxed binding resolves it back to the variable. SecurityUtils.getSecurityOption already lowercases and strips dashes, so the canonical name matches the same option. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com> (cherry picked from commit 27fb340)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick of #1913 onto
camel-spring-boot-4.22.x.Original PR: #1913 — camel-spring-boot - see camel properties supplied as environment variables
JIRA: CAMEL-24503
What it fixes
CamelSecurityPolicyAutoConfiguration.extractCamelPropertiescollected candidate properties bymatching each Spring
Environmentproperty name literally against thecamel.prefix. That worksfine for properties coming from
application.properties/YAML, but thesystemEnvironmentpropertysource reports names in their native form (e.g.
CAMEL_COMPONENT_FOO_BAR), which never starts withcamel.— even though Spring Boot's relaxed binding still applies that value to the Camel componentregardless of how it is expressed.
The practical effect was a security-policy bypass: the
camel.securitypolicy check introduced inCAMEL-23250 was blind to any Camel option supplied via environment variables, which is the standard
way to configure a containerised deployment (Docker/Kubernetes env vars,
.envfiles, etc.). Apolicy-violating option set that way would silently take effect on the component while going
completely unnoticed by the check.
The fix canonicalizes each reported property name with
ConfigurationPropertyName.adapt(name, '_')before testing the
camel.prefix, and performs the environment lookup using that canonical name sorelaxed binding resolves it back to the actual value.
SecurityUtils.getSecurityOptionalreadylowercases and strips dashes, so the canonicalized name still matches the same security option
correctly.
Branch applicability
Confirmed camel-spring-boot-4.18.x does not carry CAMEL-23250's security-policy feature, so this fix does not
apply there — 4.22.x only.
Verification on this branch
git cherry-pick -x) applied cleanly with no conflicts; the diff touches onlyCamelSecurityPolicyAutoConfiguration.javaandCamelSecurityPolicyAutoConfigurationTest.javaincore/camel-spring-boot.CamelSecurityPolicyAutoConfigurationTestdirectly: 12/12 tests passed.core/camel-spring-bootmodule verify (mvn verify): 140 tests run, 0 failures, 0errors, 1 skipped (pre-existing, unrelated to this change), plus 2 passing integration tests
(
CamelVirtualThreadsIT). OverallBUILD SUCCESS.to the released
4.22.0to allow a from-scratch build; those edits were reverted before pushing —this PR contains only the cherry-picked commit.)
Claude Code on behalf of Federico Mariani