[
https://issues.apache.org/jira/browse/CAMEL-24417?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino resolved CAMEL-24417.
--------------------------------------
Resolution: Fixed
> camel-as2 - asynchronous MDN delivery address is used without scheme
> validation and always over a plain socket
> --------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24417
> URL: https://issues.apache.org/jira/browse/CAMEL-24417
> Project: Camel
> Issue Type: Bug
> Components: camel-as2
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> When a received AS2 message carries a Receipt-Delivery-Option header,
> ResponseMDN (lines 202-207) stores its value as
> AS2AsynchronousMDNManager.RECIPIENT_ADDRESS, and AS2ServerConnection (lines
> 516-525) hands it to a new AS2AsynchronousMDNManager built with the
> connection's userName/password/accessToken.
> AS2AsynchronousMDNManager.send() then does:
> URI uri = URI.create(recipientDeliveryAddress);
> ... connFactory.createConnection(new Socket(uri.getHost(), uri.getPort()))
> AS2HeaderUtils.addAuthorizationHeader(request, userName, password,
> accessToken);
> Three problems:
> 1. The URI scheme is never checked, and the connection is a plain
> java.net.Socket - an https delivery address is still contacted in clear text.
> 2. There is no allow-list tying the delivery address to the configured
> partner.
> 3. AS2HeaderUtils.addAuthorizationHeader() attaches the configured Basic or
> Bearer credential unconditionally, whatever host was selected.
> Proposal: validate the scheme, honour https by using the endpoint's
> SSLContextParameters, restrict delivery addresses to an operator-configured
> allow-list (empty = refuse asynchronous delivery to anything but the
> configured partner URL), and only attach credentials when the resolved host
> matches the configured partner. Also handle uri.getPort() == -1 rather than
> passing it to the Socket constructor.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
