CODEWITHSUNDEEP
restapache-camel
Kristof Jozsa
Kristof Jozsa

Reputation: 7472

Camel REST path params in headers - a security issue?

I understand that inbound REST path parameters are getting automatically mapped to Camel headers. The problem I suspect that this mechanism might get exploited, overwriting Camel headers which might be required for routes to work (like the Host header for an outbound CXFRS endpoint, to name an example), or get conflicting with them at least.

Why doesn't Camel handle REST path parameters for the request somewhere completely separately of Camel headers which in many cases are absolutely required for correct Camel component behaviour? How can one avoid conflicts between the two using the same name, or in worst case avoid this becoming a security issue?

Upvotes: 5

Views: 1091

Answers (1)

Amrut Malaji
Amrut Malaji

Reputation: 21

I am Assmuing your questions here as why should camel consider the http headers as camel header and forwards the request rest.

TO resolve this what you can do is, in Processor Create an exchange (1) with the existing Exhange(0 - orginal exchange) handle with Pattern INOUT.

and once you get the response you reuse the exchange (response exhcnage in OUT -3) and set back to Exchange(0).

    class customProcessor implements Processor {
    void process(Exchange ogx){

         Exchange exchange = ExchangeBuilder.anExchange(camelContext)
                                     .withPattern(ExchangePattern...)
                                     .withHeader(Exchange.HTTP_METHOD, HttpMethod.GET)
                                      .build();
             Exchange  responseExchange=producer.send("the end point to rest",exchange); 
//copying the exchange which has come as response from the rest to the body of //the OGX exchange.


ogx.getIn().setBody(responseExchange.getOut().getBody())


    }

    }

Upvotes: 0

Related Questions