[CAMEL-16403] camel-core - URI parsing sensitive keys

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Fix Version/s: 4.x
• Component/s: camel-core
• Estimated Complexity: Unknown
• Assignee: Unassigned
• Reporter: Claus Ibsen
• Created: 25/Mar/21 11:52
• Updated: 09/Aug/23 09:21

Description

With SensitiveUtils we know have a full list of known property names that are sensitive.
We can use this in endpoint uri parsing to know that its value should be used as-is (eg like it was RAW( ))

Thought with RAW() there is still some decoding due to URI invalid chars, eg you can't have special chars in the uri, so they get decimal encoded.

Another approach: We could also just generate a random uuid as placeholder for the value, which is backed in some internal registry/vault which then is used to lookup the actual value, when in use.

However the uri may be used to call external service, like a http / ftp with username:password combination, so you may want an uri representation with the actual value. Likewise if there is some api tokens in the uri.

Issue Links

• is related to: CAMEL-16016 Encoding special characters via UnsafeUriCharactersEncoder does not work in all cases
• is related to: CAMEL-18200 camel-core - Scheduled consumer should hide sensitive information if failed polling
• relates to: CAMEL-18370 Bidning properties to route template local beans do not honor RAW()
• relates to: CAMEL-18385 camel-kamelet - Endpoint URIs from parameters could be passed as-is without uri encoding