oscerd opened a new pull request, #735: URL: https://github.com/apache/camel-karaf/pull/735
Fixes #730 ## What `camel:endpoint-list`, `camel:endpoint-stats` and `camel:rest-registry-list` each url-decode the endpoint uri before printing it, with `--decode` defaulting to `true`. `URISupport.sanitizeUri` masks credentials but does not touch control characters, so a percent-encoded ESC/LF/BEL was re-armed by the decode and handed to `ShellTable` as raw bytes. The uris shown are not all route-author literals. `getEndpoints()` includes endpoints materialised by the dynamic EIPs, and `RuntimeEndpointRegistry` tracks dynamic endpoints by design, so a uri can contain a substring that arrived on the wire. A raw LF splits the row and lets one endpoint render as two; ESC sequences are acted on by the terminal emulator. This is the view an operator uses to see what a context is actually connected to, so a garbled or forgeable rendering is worth avoiding regardless of how the content got there. ## How The shared decode + sanitize is folded into `ShellUriHelper.prepareUriForDisplay(uri, decode)`, which puts control characters back into percent-encoded form as its last step -- so nothing downstream can reintroduce one. Re-encoding rather than stripping means the display stays faithful: the operator sees `%1B` exactly where the uri really has an ESC, and readability of ordinary escapes (`%20` -> space) is unchanged. It also applies when `--decode` is `false`, which covers a uri that carries a literal control character without any encoding. `RestRegistryList` had the same three lines and is fixed with the other two. While here: an undecodable uri no longer aborts the whole listing. A malformed `%` sequence made `URLDecoder.decode` throw `IllegalArgumentException`, which took out every row rather than just the offending one. ## Tests Adds `ShellUriHelperTest` (16 cases) covering decode-still-readable, credential masking, each of the encoded control characters, the OSC/newline row-forging shapes, the literal-control-character path, and the malformed escape. The shell module had no test sources, so this also adds the `junit-jupiter` test dependencies. ``` Tests run: 16, Failures: 0, Errors: 0, Skipped: 0 BUILD SUCCESS ``` ## Notes No behaviour change for a well-formed uri -- the fast path returns the string unchanged when it contains no control character. --- _Claude Code on behalf of Andrea Cosentino_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
