Claus Ibsen created CAMEL-26010:
-----------------------------------
Summary: camel-xmlsecurity - the catalog defaults of
secureTagContents and keyCipherAlgorithm differ from the code, and secureTag
reads the body twice
Key: CAMEL-26010
URL: https://issues.apache.org/jira/browse/CAMEL-26010
Project: Camel
Issue Type: Bug
Components: camel-xmlsecurity
Affects Versions: 4.18.0, 4.22.0, 4.23.0
Reporter: Claus Ibsen
Fix For: 4.24.0
Three problems with the xmlSecurity data format:
* *secureTagContents*: the catalog and the options table of the docs say it
defaults to false, encrypting the element. The data format sets it to true
({{XMLSecurityDataFormat}}, main 56aa5f4970a6, line 181), and the reifier does
not set an option the route leaves out. So with {{secureTag}} and no
{{secureTagContents}}, only the content of the element is encrypted.
* *keyCipherAlgorithm*: the catalog says it defaults to RSA_OAEP. The runtime
default is null: marshal uses RSA_OAEP when recipientKeyAlias is set, and
unmarshal without keyCipherAlgorithm takes the symmetric path (read from the
code).
* *The body is read twice with secureTag*: the data format converts the body to
a Document (line 354 on marshal, 526 on unmarshal). The XPath of secureTag then
reads the body of the message again (lines 495-497 and 629-631). A stream that
is not a stream cache, for example with stream caching off, has been read
already, so the XPath fails.
Checked on 4.24.0-SNAPSHOT with {{camel run}}:
* {{<order><id>1</id><name>Camel</name></order>}} with {{marshal:
xmlSecurity}}, {{passPhrase}} and {{secureTag: /order/name}}, and no
{{secureTagContents}}: EncryptedData with Type
{{http://www.w3.org/2001/04/xmlenc#Content}}, inside {{<name>}};
* the same body as a {{ByteArrayInputStream}}, with
{{camel.main.streamCachingEnabled=false}}: TypeConversionException to Document,
due to {{SAXParseException: Premature end of file}}.
*Proposed change*: give the model options the defaults the code uses (or the
reverse), and evaluate the XPath on the Document the data format has parsed,
instead of on the body again.
_Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
