"a16b68f93a16576502ef1062ce4006be7d41cbc7": "CAMEL-24220: Add camel_security_scan tool for route security analysis (#25026)\n\n* CAMEL-24220: Add camel_security_scan tool for route security analysis\n\nAdds a new MCP tool that performs static analysis of Camel route definitions\nto detect security anti-patterns. Distinct from camel_route_harden_context\n(which provides general security context and CVE advisories), this tool\nperforms line-by-line analysis and returns actionable findings with severity,\nline numbers, and remediation guidance.\n\nDetection categories:\n- Insecure options from SecurityUtils (trustAllCertificates, allowJavaSerializedObject,\n transferException, etc. \u2014 24 options across ssl/serialization/dev categories)\n- Plain-text secrets in URIs (password, token, apiKey, etc.)\n- Connection strings with embedded credentials (mongodb://, amqp://, etc.)\n- Unencrypted protocols (HTTP vs HTTPS, FTP vs SFTP, LDAP vs LDAPS, SMTP vs SMTPS)\n- Missing Camel* header filters on HTTP consumers (CVE-2025-27636 family)\n- Command injection via exec component\n- SQL injection risk (missing parameterized queries)\n- File path traversal with dynamic expressions\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>\nSigned-off-by: Andrea Cosentino <ancosen@gmail.com>\n\n* CAMEL-24220: Address review feedback\n\n- Fix RAW() false negative: remove RAW() negative lookahead from\n SECRET_IN_URI regex \u2014 RAW() is a URI encoding wrapper, not a\n security mechanism\n- Fix empty insecureValue false positives: skip options with empty\n insecureValue to avoid matching any assignment\n- Fix SQL scheme false positive on composite schemes: use boundary\n check in containsScheme() to avoid matching google-bigquery-sql:\n as sql:\n- Fix route-level header filter check: scope per-consumer line with\n hasHeaderFilterNearby() instead of checking entire route text\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>\nSigned-off-by: Andrea Cosentino <ancosen@gmail.com>\n\n* CAMEL-24220: Add regression tests and cleanup\n\n- Add 4 regression tests for fixed bugs: RAW() detection, empty\n insecureValue, composite scheme SQL, per-consumer header filter\n- Add explicit parentheses in containsScheme() for readability\n- Remove dead findLineContaining() method\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>\nSigned-off-by: Andrea Cosentino <ancosen@gmail.com>\n\n* CAMEL-24220: delegate insecure-option matching to SecurityUtils.isInsecureValue\n\nAddresses the remaining gnodet review point on scanInsecureOptions: instead of\nreimplementing the value comparison with lower.contains(optionKey + \"=\" +\ninsecureValue) \u2014 which either false-positived on empty insecureValue\n(sslEndpointAlgorithm= matched any assignment) or, after guarding, skipped\nthose options entirely \u2014 the scanner now extracts the assigned value and calls\nSecurityUtils.isInsecureValue(). That is the canonical check: case-insensitive,\nand it models the sslEndpointAlgorithm case where the empty/none/false value is\nthe insecure one. So sslEndpointAlgorithm=HTTPS is not flagged while\nsslEndpointAlgorithm=none now is (previously silently dropped).\n\nAdds flagsSslEndpointAlgorithmDisabled to pin the restored coverage.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\nSigned-off-by: Andrea Cosentino <ancosen@gmail.com>\n\n---------\n\nSigned-off-by: Andrea Cosentino <ancosen@gmail.com>\nCo-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
0 commit comments