[
https://issues.apache.org/jira/browse/CAMEL-24441?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen resolved CAMEL-24441.
---------------------------------
Resolution: Fixed
> camel-crypto-pgp - unmarshal accepts unsigned and non-integrity-protected
> messages by default
> ---------------------------------------------------------------------------------------------
>
> Key: CAMEL-24441
> URL: https://issues.apache.org/jira/browse/CAMEL-24441
> Project: Camel
> Issue Type: Bug
> Components: camel-crypto
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> Two defaults in {{PGPKeyAccessDataFormat.unmarshal()}} (and the
> {{PGPDataFormat}} subclass) let the incoming message decide whether it is
> verified:
> 1. The MDC integrity check runs inside {{if (pbe.isIntegrityProtected())}}. A
> message packaged as a legacy SED packet, which carries no MDC, skips the
> check entirely. The {{integrity}} option (default {{true}}) governs
> *marshalling* only - there is no decrypt-side equivalent that requires
> integrity protection to be present.
> 2. {{signatureVerificationOption}} defaults to {{"optional"}}, so a message
> carrying no signature skips verification altogether ({{verifySignature}} is a
> no-op when there is nothing to verify).
> The net effect is that the default decrypt path provides confidentiality but
> no authenticity, and the sender of the message chooses which checks apply.
> Proposal: add a decrypt-side option requiring integrity protection, and
> consider defaulting {{signatureVerificationOption}} to {{"required"}} (or at
> least {{"ifPresent"}} + require-integrity) in the next minor. Both are
> behaviour changes and need upgrade-guide entries.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
