[
https://issues.apache.org/jira/browse/CAMEL-24417?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18108212#comment-18108212
]
Andrea Cosentino commented on CAMEL-24417:
------------------------------------------
Merged to main: https://github.com/apache/camel/pull/25637 (ff2b608d77ba)
TLS delivery of asynchronous MDNs is tracked separately as CAMEL-24474.
_Claude Code on behalf of oscerd_
> camel-as2 - asynchronous MDN delivery address is used without scheme
> validation and always over a plain socket
> --------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24417
> URL: https://issues.apache.org/jira/browse/CAMEL-24417
> Project: Camel
> Issue Type: Bug
> Components: camel-as2
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> When a received AS2 message carries a Receipt-Delivery-Option header,
> ResponseMDN (lines 202-207) stores its value as
> AS2AsynchronousMDNManager.RECIPIENT_ADDRESS, and AS2ServerConnection (lines
> 516-525) hands it to a new AS2AsynchronousMDNManager built with the
> connection's userName/password/accessToken.
> AS2AsynchronousMDNManager.send() then does:
> URI uri = URI.create(recipientDeliveryAddress);
> ... connFactory.createConnection(new Socket(uri.getHost(), uri.getPort()))
> AS2HeaderUtils.addAuthorizationHeader(request, userName, password,
> accessToken);
> Three problems:
> 1. The URI scheme is never checked, and the connection is a plain
> java.net.Socket - an https delivery address is still contacted in clear text.
> 2. There is no allow-list tying the delivery address to the configured
> partner.
> 3. AS2HeaderUtils.addAuthorizationHeader() attaches the configured Basic or
> Bearer credential unconditionally, whatever host was selected.
> Proposal: validate the scheme, honour https by using the endpoint's
> SSLContextParameters, restrict delivery addresses to an operator-configured
> allow-list (empty = refuse asynchronous delivery to anything but the
> configured partner URL), and only attach credentials when the resolved host
> matches the configured partner. Also handle uri.getPort() == -1 rather than
> passing it to the Socket constructor.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
