Claus Ibsen created CAMEL-26279:
-----------------------------------
Summary: camel-cyberark-vault - verifySsl and certificatePath are
ignored, the secret version is not encoded, and getSecret copies the secret
into a header
Key: CAMEL-26279
URL: https://issues.apache.org/jira/browse/CAMEL-26279
Project: Camel
Issue Type: Bug
Reporter: Claus Ibsen
Fix For: 4.24.0
Found while adding the catalog body types of cyberark-vault (CAMEL-24961, PR
#28404).
h4. 1. verifySsl and certificatePath are ignored
{{CyberArkVaultConfiguration}} has {{verifySsl}} (default true, line 63) and
{{certificatePath}} (line 66), but {{ConjurClientImpl}} (main 2a465aa4814c,
line 57) builds a plain {{HttpClient}} with the default trust of the JVM and
uses neither. So a Conjur server with a certificate of a private CA cannot be
used with {{certificatePath}}, and {{verifySsl=false}} does nothing.
Proposed: build the SSLContext of the client from these options, and mark
{{verifySsl}} with {{security = "insecure:ssl"}} so the security policy can
report it.
h4. 2. The secret version is not encoded
The {{CamelCyberArkVaultSecretVersion}} header is appended to the URL as
{{"?version=" + version}} (line 83) without encoding.
Proposed: URL-encode it.
h4. 3. getSecret copies the secret value into a header
{{CyberArkVaultProducer}} (line 70) sets the secret both as the body and in the
{{CamelCyberArkVaultSecretValue}} header. The header then travels with the
message, and a later createSecret in the same exchange writes that header value
instead of its body (CAMEL-26256 item).
Proposed: set the secret only as the body, with an entry in the upgrade guide.
_Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
