oscerd commented on PR #26726:
URL: https://github.com/apache/camel/pull/26726#issuecomment-5812349533

   Thanks for the thorough re-review — and for verifying the `xml:id` branch is 
live (`XmlVerifierProcessor:288` → `setNamespaceAware(true)`) and confirming 
the `wsu:Id` exclusion reasoning. Agreed on both.
   
   Two things done:
   
   1. **Port label removed.** You're right that the public 
`isEnforceReferenceCoverage`/`setEnforceReferenceCoverage` pair is API growth 
for a patch line. `enforceReferenceCoverage` is opt-in and off by default, so 
it's main/4.23 material rather than a maintenance backport. Dropped 
`port/camel-4.22.x`; if 4.22.x wants the protection later, that can be a 
separate, deliberate call.
   
   2. **End-to-end wiring test added** — 
`XmlSignatureTest#enforceReferenceCoverageRejectsASignatureCoveringOnlyASubElement`.
 Instead of DOM-wrapping, it uses the detached-signature path: a real signature 
that covers a sub-element by id while the whole document is emitted — the same 
shape as the wrapping attack. With `enforceReferenceCoverage` on, 
`xmlsecurity-verify` rejects it. I verified it fails when the `mapToMessage` 
call site is deleted (`mock:enforceCoverageResult` receives the message instead 
of `mock:exception`), so it covers the wiring, not just the predicate.
   
   One heads-up: the "apply suggestion" commit that improved the null-URI 
comment left an unmatched `}` that broke compilation — fixed in f512ed9. The 
improved comment itself is kept; it reads better than my original.
   
   _Claude Code on behalf of oscerd_
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to