oscerd commented on PR #26726: URL: https://github.com/apache/camel/pull/26726#issuecomment-5812349533
Thanks for the thorough re-review — and for verifying the `xml:id` branch is live (`XmlVerifierProcessor:288` → `setNamespaceAware(true)`) and confirming the `wsu:Id` exclusion reasoning. Agreed on both. Two things done: 1. **Port label removed.** You're right that the public `isEnforceReferenceCoverage`/`setEnforceReferenceCoverage` pair is API growth for a patch line. `enforceReferenceCoverage` is opt-in and off by default, so it's main/4.23 material rather than a maintenance backport. Dropped `port/camel-4.22.x`; if 4.22.x wants the protection later, that can be a separate, deliberate call. 2. **End-to-end wiring test added** — `XmlSignatureTest#enforceReferenceCoverageRejectsASignatureCoveringOnlyASubElement`. Instead of DOM-wrapping, it uses the detached-signature path: a real signature that covers a sub-element by id while the whole document is emitted — the same shape as the wrapping attack. With `enforceReferenceCoverage` on, `xmlsecurity-verify` rejects it. I verified it fails when the `mapToMessage` call site is deleted (`mock:enforceCoverageResult` receives the message instead of `mock:exception`), so it covers the wiring, not just the predicate. One heads-up: the "apply suggestion" commit that improved the null-URI comment left an unmatched `}` that broke compilation — fixed in f512ed9. The improved comment itself is kept; it reads better than my original. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
