oscerd opened a new pull request, #26656: URL: https://github.com/apache/camel/pull/26656
This fixes [CAMEL-24431](https://issues.apache.org/jira/browse/CAMEL-24431). `HttpMessageUtils.extractEdiPayloadFromCompressedEntity()` expanded a compressed AS2 entity with an unbounded `ZlibExpanderProvider`. The expansion happens while the payload is extracted — **before the signature is established** — so the work is done on behalf of a sender that is not yet authenticated, and zlib reaches roughly 1000:1. An unauthenticated sender can therefore force a large in-memory expansion from a tiny request (a decompression bomb / DoS). The expansion is now bounded by `MAX_COMPRESSED_ENTITY_EXPANSION`, set well above any realistic EDI payload, with a public overload accepting an explicit bound for a deployment that needs a different value. All four call sites are internal statics with no configuration threaded through, and passing an endpoint option down would mean changing several public `camel-as2-api` signatures — hence a constant plus the explicit-bound overload rather than a new endpoint option. **Test:** `CompressedEntityExpansionBoundTest` — refused at a 1 KiB bound with "Failed to decompress data" (from `EntityParser.uncompressData`), successful at 10 MiB. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
