Dhairya-007 opened a new pull request, #29417:
URL: https://github.com/apache/camel/pull/29417
`GrpcProducer.doStart()` validates the wrong option on the
`authenticationType=GOOGLE` path.
```java
if (configuration.getAuthenticationType() == GrpcAuthType.GOOGLE) {
ObjectHelper.notNull(configuration.getKeyCertChainResource(),
"serviceAccountResource");
Credentials creds = GoogleCredentials.fromStream(
ResourceHelper.resolveResourceAsInputStream(endpoint.getCamelContext(),
configuration.getServiceAccountResource()));
```
It null-checks `keyCertChainResource` but reports it as
`serviceAccountResource`, and then reads `serviceAccountResource` for the
credentials.
### Why the guard can never fire
The producer constructor rejects `GOOGLE` unless `negotiationType=TLS`:
```java
if (configuration.getAuthenticationType() == GrpcAuthType.GOOGLE
&& configuration.getNegotiationType() != NegotiationType.TLS) {
throw new IllegalStateException("Google token-based authentication
requires SSL/TLS negotiation mode");
}
```
and `initializeChannel()`, which `doStart()` calls one line earlier, already
asserts for TLS:
```java
ObjectHelper.notNull(configuration.getKeyCertChainResource(),
"keyCertChainResource");
```
So by the time the `GOOGLE` branch runs, `keyCertChainResource` is always
non-null and the check is dead. A route that sets `authenticationType=GOOGLE`
and forgets `serviceAccountResource` goes straight into
`ResourceHelper.resolveResourceAsInputStream` with a null uri, where
`resolveResource` does `uri.startsWith(RESOURCE)` and throws a bare
`NullPointerException` instead of naming the option that is missing.
### Verification
Building just `camel-grpc` locally means building most of Camel at the
current SNAPSHOT, so I checked the ordering in a standalone harness that
replicates `doStart()`, `ObjectHelper.notNull` and
`ResourceHelper.resolveResource`:
```
serviceAccountResource missing, keyCertChainResource set (TLS, so always
set):
before: NullPointerException: Cannot invoke "String.startsWith(String)"
because "<parameter1>" is null
after : IllegalArgumentException: serviceAccountResource must be specified
```
The new case in `GrpcProducerConfigurationTest` covers the same route
configuration — TLS set up from the existing `src/test/resources/certs` client
material, `serviceAccountResource` omitted — and fails with the
`NullPointerException` against the current code.
Nothing else reads `keyCertChainResource` here, so the TLS behaviour is
unchanged; the `keyCertChainResource` assertion in `initializeChannel()` is
left as it is.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
