oscerd opened a new pull request, #24082: URL: https://github.com/apache/camel/pull/24082
Backport of CAMEL-23782 to the `camel-4.18.x` maintenance branch (main PR: apache/camel#24078). `DefaultLevelDBSerializer.deserializeKey` read aggregation-repository key bytes through a raw `ObjectInputStream` with no filter, while the exchange deserialization path on this branch already installs an `ObjectInputFilter`. This applies a `String`-scoped filter (keys are always `java.lang.String`) plus JEP-290 graph-shape limits, closing the matching gap on this branch. ## Changes - `DefaultLevelDBSerializer.deserializeKey` installs a `String`-scoped `ObjectInputFilter`. - New unit test `DefaultLevelDBSerializerKeyFilterTest` (String round-trip + non-String payload rejected). ## Notes - Clean cherry-pick of the main commit; no public API change; the `@Deprecated` `LevelDBSerializer` / `LevelDBCamelCodec` are untouched. - Non-breaking: the repository reads keys as plain UTF-8 (`LevelDBAggregationRepository.getKeys()`), and the Java-serialized key path is only reachable via the deprecated codec — no upgrade-guide entry. - Verified: `camel-leveldb` module build + tests on `camel-4.18.x` (76 passed). The change is identical to the main fix, which passed a full reactor build in #24078. Jira: https://issues.apache.org/jira/browse/CAMEL-23782 _Claude Code on behalf of Andrea Cosentino_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
