Class SecurityUtils

java.lang.Object

org.apache.camel.util.SecurityUtils

public final class SecurityUtils
extends Object

Utility for detecting insecure configuration options.

The security options map is generated by camel build tools from @Metadata(security=...) and @UriParam(security=...) annotations.

Since:

4.19.0

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	SecurityUtils.SecurityOption	Information about a security-sensitive configuration option.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	INSECURE_DEV
static final String	INSECURE_SERIALIZATION
static final String	INSECURE_SSL

Method Summary

Modifier and Type	Method	Description
static List<SecurityViolation>	detectViolations(Map<String,Object> properties, BiPredicate<String,Object> secretDetector, UnaryOperator<String> policyResolver, Set<String> allowedKeys)	Detect security policy violations in a set of configuration properties.
static SecurityUtils.SecurityOption	getSecurityOption(String text)	Get security information for a configuration property.
static Map<String, SecurityUtils.SecurityOption>	getSecurityOptions()	All the security options (unmodifiable)
static boolean	isInsecureValue(String text, Object value)	Whether the given configuration property value is the insecure value for the property.
static boolean	isPlainTextSecret(Object value)	Whether the given property value appears to be a plain-text secret (not using vault, env var, or system property placeholders).

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

INSECURE_SSL

public static final String INSECURE_SSL

See Also:

• Constant Field Values

INSECURE_SERIALIZATION

public static final String INSECURE_SERIALIZATION

See Also:

• Constant Field Values

INSECURE_DEV

public static final String INSECURE_DEV

See Also:

• Constant Field Values

Method Details

getSecurityOptions

public static Map<String, SecurityUtils.SecurityOption> getSecurityOptions()

All the security options (unmodifiable)

getSecurityOption

public static SecurityUtils.SecurityOption getSecurityOption(String text)

Get security information for a configuration property.

Parameters:

text - the configuration property key (e.g., "camel.component.http.trustAllCertificates")

Returns:

the security option info, or null if the property has no security category

isInsecureValue

public static boolean isInsecureValue(String text,
 Object value)

Whether the given configuration property value is the insecure value for the property.

Parameters:

text - the configuration property key

value - the property value

Returns:

true if the value is the insecure value for this property, false otherwise

isPlainTextSecret

public static boolean isPlainTextSecret(Object value)

Whether the given property value appears to be a plain-text secret (not using vault, env var, or system property placeholders).

Parameters:

value - the property value to check

Returns:

true if the value is plain text (not secured via a placeholder mechanism)

detectViolations

public static List<SecurityViolation> detectViolations(Map<String,Object> properties,
 BiPredicate<String,Object> secretDetector,
 UnaryOperator<String> policyResolver,
 Set<String> allowedKeys)

Detect security policy violations in a set of configuration properties.

This method checks for both plain-text secrets and insecure configuration options based on the security options map and the provided policy resolver.

Parameters:

properties - map of property key → value pairs to check

secretDetector - predicate that returns true if a property key+value pair represents a sensitive secret

policyResolver - function that resolves the effective policy ("allow", "warn", "fail") for a given security category

allowedKeys - set of property keys to skip (allowed explicitly by the user)

Returns:

list of violations found (may be empty)