CAMEL-23250: Security policy enforcement with profile-aware defaults

[gnodet]

Summary

Built-in security policy enforcement that detects insecure configuration at startup and either warns or prevents the application from starting.

• 4 security categories: secret (plain-text passwords), insecure:ssl (disabled cert verification), insecure:serialization (Java object deserialization), insecure:dev (dev-only features in prod)
• 3 policy levels: allow (silent), warn (log, default), fail (block startup)
• Profile-aware: prod profile auto-sets policy=fail; dev profile auto-sets insecureDevPolicy=allow
• Per-category overrides: e.g. camel.security.insecureSslPolicy=allow while global is fail
• Allowlist: exempt specific properties via camel.security.allowedProperties
• Health check: exposes violations via Camel health check API (DOWN for fail-level only, UP with details for warn-level)
• Programmatic API: SecurityPolicyResult accessible as a CamelContext plugin
• Design proposal: proposals/security.adoc — full design doc for the security framework

Commit structure (for easier review)

1. b0834ac Fix missing secret=true annotations — CyberArk authToken, IBM Event Streams eventStreamUsername/eventStreamPassword (2 files)
2. 5c89a07 Security policy enforcement framework — all new classes, tooling, component annotations, tests, docs (90 files)
3. ca52d14 Regenerate catalog and generated files — JSON metadata and endpoint DSL (423 files, reviewers can skip this commit)
4. bfff8e6 Add security design proposal and update AGENTS.md — proposals/security.adoc design doc + area-to-proposal mapping in AGENTS.md/CLAUDE.md
5. 54ffc82 Fix generated main.adoc — remove stale {zwsp} markers
6. 2674828 Address review findings — carry policy in violations, RAW() as insecure, case-insensitive policy, health check fix, dev profile defaults, missing annotations on netty/activemq/aggregation repos, expanded tests (42 total), doc fixes

Key files to review

Framework core:

• core/camel-util/…/SecurityUtils.java — detection logic + security options map
• core/camel-util/…/SecurityViolation.java — violation record (now carries effective policy)
• core/camel-main/…/SecurityConfigurationProperties.java — camel.security.* config (case-insensitive policy)
• core/camel-main/…/SecurityPolicyResult.java — runtime result API
• core/camel-main/…/BaseMainSupport.java — enforcement wiring at startup
• core/camel-main/…/ProfileConfigurer.java — prod → fail, dev → insecureDevPolicy=allow

Design proposal:

• proposals/security.adoc — full design doc

Tooling (annotation → generated map pipeline):

• tooling/spi-annotations/…/UriParam.java — new security() attribute
• tooling/…/UpdateSensitizeHelper.java — generates SecurityUtils.java map

Health check:

• core/camel-health/…/SecurityPolicyHealthCheck.java — DOWN for fail only, UP with details for warn

Tests & docs:

• core/camel-main/…/MainSecurityPolicyTest.java — 32 tests covering all policy levels, categories, overrides, profiles, case-insensitivity
• core/camel-util/…/SecurityUtilsTest.java — 10 unit tests for detection logic
• docs/…/security.adoc — user documentation
• docs/…/camel-4x-upgrade-guide-4_19.adoc — upgrade guide entry

Test plan

• 32 unit tests in MainSecurityPolicyTest (all policy levels, categories, overrides, profiles, case-insensitivity, multiple violations, policy carried in violations)
• 10 unit tests in SecurityUtilsTest (plain-text detection, getSecurityOption, isInsecureValue, detectViolations, allowed keys, null handling)
• Build succeeds with mvn install -B -pl core/camel-main -DskipTests -am
• All tests pass with mvn test -B -pl core/camel-main -Dtest=MainSecurityPolicyTest
• All tests pass with mvn test -B -pl core/camel-util -Dtest=SecurityUtilsTest
• Generated files are up to date (no uncommitted changes after build)
• Code formatted with mvn formatter:format impsort:sort

Follow-up ideas

Findings from a security audit that are not covered by this PR but could be addressed in follow-up tickets:

Near-term

1. Infinispan deserialization filter — DefaultExchangeHolderUtils uses ClassLoadingAwareObjectInputStream without JEP-290 setObjectInputFilter(). Should add the same default filter (java.**;org.apache.camel.**;!*) used by SQL/LevelDB/Cassandra/Consul stores.

2. TLS protocol version filtering — Splunk and Paho MQTT expose SSLv3/TLSv1 in their protocol enums. The global SSLContextParameters default filtering only excludes SSL.* regex. Consider also excluding TLSv1 and TLSv1.1 by default.

Medium-term

3. FIPS compliance category — The framework already supports arbitrary categories via resolvePolicy()'s default → null fallback. Adding insecure:fips requires annotating non-FIPS algorithms and adding a fipsPolicy field to SecurityConfigurationProperties.

4. SSRF mitigation — Add an optional URI whitelist mechanism for toD/recipientList dynamic routing.

5. Expression language sandboxing — OGNL, Groovy, MVEL, SpEL all allow arbitrary code execution. Not config-level (the framework can't catch this), but documenting the risk in security.adoc would help users make informed choices.

Low priority

6. HTTP header CRLF validation — Add header value sanitization in camel-http-common to prevent header injection.

7. MongoDB trust-all TrustManager — SslAwareMongoClient hardcodes a trust-all TrustManager. Not trackable by the annotation framework since it's programmatic, not a @UriParam.

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using build-all, build-dependents, skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.