[
https://issues.apache.org/jira/browse/CAMEL-26201?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen updated CAMEL-26201:
--------------------------------
Description:
Found while adding the catalog body types of crypto (CAMEL-24961, PR #28416).
h4. 1. A stream body is consumed by sign and verify
{{DigitalSignatureProcessor.calculateSignature}} (main 2a465aa4814c, line 41 to
53), used by sign and verify, reads the body as an InputStream and closes it.
With stream caching off, the body is a plain stream that cannot be read again,
so the next step of the route gets an empty body. Checked on 4.24.0-SNAPSHOT
with in-memory key pairs and stream caching turned off.
Proposed: cache the stream (or reset it when it is a StreamCache) and put it
back as the body after reading.
h4. 2. verify: the header key wins, and a null body verifies as an empty payload
{{VerifyingProcessor}} (main 2a465aa4814c, lines 44-49 and 76-79) uses the
{{CamelSignaturePublicKeyOrCert}} header, when set, over the {{publicKey}} or
{{certificate}} of the endpoint; the page does not say so. A null body is
verified as an empty payload instead of failing. Checked on 4.24.0-SNAPSHOT
in-process.
Proposed: document that the header wins over the configured key, and make
verify fail when there is no body.
_Claude Code on behalf of davsclaus_
was:
Found while adding the catalog body types of crypto (CAMEL-24961, PR #28416).
h4. 1. A stream body is consumed by sign and verify
{{DigitalSignatureProcessor.calculateSignature}} (main 2a465aa4814c, line 41 to
53), used by sign and verify, reads the body as an InputStream and closes it.
With stream caching off, the body is a plain stream that cannot be read again,
so the next step of the route gets an empty body. Checked on 4.24.0-SNAPSHOT
with in-memory key pairs and stream caching turned off.
Proposed: cache the stream (or reset it when it is a StreamCache) and put it
back as the body after reading.
_Claude Code on behalf of davsclaus_
> camel-crypto - with stream caching off, signing reads and closes a stream
> body: the next step gets an empty body
> ----------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26201
> URL: https://issues.apache.org/jira/browse/CAMEL-26201
> Project: Camel
> Issue Type: Bug
> Components: camel-crypto
> Reporter: Claus Ibsen
> Priority: Minor
> Fix For: 4.24.0
>
>
> Found while adding the catalog body types of crypto (CAMEL-24961, PR #28416).
> h4. 1. A stream body is consumed by sign and verify
> {{DigitalSignatureProcessor.calculateSignature}} (main 2a465aa4814c, line 41
> to 53), used by sign and verify, reads the body as an InputStream and closes
> it. With stream caching off, the body is a plain stream that cannot be read
> again, so the next step of the route gets an empty body. Checked on
> 4.24.0-SNAPSHOT with in-memory key pairs and stream caching turned off.
> Proposed: cache the stream (or reset it when it is a StreamCache) and put it
> back as the body after reading.
> h4. 2. verify: the header key wins, and a null body verifies as an empty
> payload
> {{VerifyingProcessor}} (main 2a465aa4814c, lines 44-49 and 76-79) uses the
> {{CamelSignaturePublicKeyOrCert}} header, when set, over the {{publicKey}} or
> {{certificate}} of the endpoint; the page does not say so. A null body is
> verified as an empty payload instead of failing. Checked on 4.24.0-SNAPSHOT
> in-process.
> Proposed: document that the header wins over the configured key, and make
> verify fail when there is no body.
> _Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
