oscerd opened a new pull request, #26065: URL: https://github.com/apache/camel/pull/26065
## Issue [CAMEL-24607](https://issues.apache.org/jira/browse/CAMEL-24607) ## Problem In non-strict mode `CodeInjectionGuardrail.validate()` collects every matched pattern's `InjectionType` into a `List` **without de-duplication**, then blocks the input when `detected.size() >= 2`. The inline comment says the intent is to require "multiple **different** types", but several patterns share a type (4 SHELL_COMMAND, 4 SQL_INJECTION, 3 JAVASCRIPT, 2 HTML_XSS, 3 TEMPLATE_INJECTION). So a single legitimate input matching two patterns of **one** type is falsely blocked — e.g. a normal templating question `render {{name}} and ${value}` matches both `{{...}}` and `${...}` (both `TEMPLATE_INJECTION`) and is rejected. The sibling `PromptInjectionGuardrail` de-duplicates correctly. ## Fix Only add a type when it is not already present, so `detected.size() >= 2` genuinely means two distinct types matched. ## Testing - New `testNonStrictModeDoesNotBlockMultipleMatchesOfTheSameType` asserts the templating example passes; verified it **fails** against the unpatched code and passes with the fix. All existing `CodeInjectionGuardrailTest` cases still pass. - `mvn -Psourcecheck validate` green. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ka4dAcJMpxahMfk3kmG5Ls -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
