Copilot commented on code in PR #3420:
URL: https://github.com/apache/tika/pull/3420#discussion_r4382171785
##########
tika-core/src/main/resources/org/apache/tika/mime/tika-mimetypes.xml:
##########
@@ -4991,6 +4991,16 @@
<mime-type type="application/x-pkcs7-certificates">
<glob pattern="*.p7b"/>
<glob pattern="*.spc"/>
+ <!-- certs-only SignedData: empty digestAlgorithms (31 00) and an
id-data-only encapContentInfo,
+ so no signature; outranks the pkcs7-signature magic. Version byte
masked; offset spans DER length forms. -->
+ <magic priority="60">
+ <match value="0x30" offset="0">
+ <match value="0x06092a864886f70d010702" type="string" offset="2:6">
+ <match value="0x0201013100300b06092a864886f70d010701" type="string"
+ mask="0xFFFF00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF" offset="17:29"/>
Review Comment:
An empty `digestAlgorithms` set does not establish that `signerInfos` is
empty: clearing only that set in `testPKCS7_signature_def.p7s` preserves its
signer and signature bytes but makes this higher-priority rule label it as
certificates-only. Check the actual absence of signers before assigning this
type, using structural CMS detection where the prefix cannot establish that.
##########
tika-core/src/main/resources/org/apache/tika/mime/tika-mimetypes.xml:
##########
@@ -4991,6 +4991,16 @@
<mime-type type="application/x-pkcs7-certificates">
<glob pattern="*.p7b"/>
<glob pattern="*.spc"/>
+ <!-- certs-only SignedData: empty digestAlgorithms (31 00) and an
id-data-only encapContentInfo,
+ so no signature; outranks the pkcs7-signature magic. Version byte
masked; offset spans DER length forms. -->
+ <magic priority="60">
+ <match value="0x30" offset="0">
+ <match value="0x06092a864886f70d010702" type="string" offset="2:6">
+ <match value="0x0201013100300b06092a864886f70d010701" type="string"
+ mask="0xFFFF00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF" offset="17:29"/>
Review Comment:
The fixed `30 0b` encoding misses certificates-only bundles whose
encapContentInfo uses BER indefinite length. The existing
`testPKCS7_certs_only_ind.p7c` contains `30 80 ... 00 00`, so it fails this
rule and still falls through to `application/pkcs7-signature`, despite
containing no signers or content. Please handle the indefinite-length encoding
and include that fixture in `testCertsOnlyDetectedByContent`.
##########
tika-core/src/main/resources/org/apache/tika/mime/tika-mimetypes.xml:
##########
@@ -4991,6 +4991,16 @@
<mime-type type="application/x-pkcs7-certificates">
<glob pattern="*.p7b"/>
<glob pattern="*.spc"/>
+ <!-- certs-only SignedData: empty digestAlgorithms (31 00) and an
id-data-only encapContentInfo,
+ so no signature; outranks the pkcs7-signature magic. Version byte
masked; offset spans DER length forms. -->
+ <magic priority="60">
+ <match value="0x30" offset="0">
+ <match value="0x06092a864886f70d010702" type="string" offset="2:6">
+ <match value="0x0201013100300b06092a864886f70d010701" type="string"
+ mask="0xFFFF00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF" offset="17:29"/>
+ </match>
+ </match>
+ </magic>
Review Comment:
The new detected type has no parser registration or CMS supertype, so
default auto-detect parsing falls back to `EmptyParser` instead of running
`Pkcs7Parser` and its `smime-type=certs-only` refinement. Declare this type as
a subclass of `application/pkcs7-mime` to preserve parser routing, and add an
auto-detect parsing regression test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
