[jira] [Commented] (CAMEL-24444) camel-xmlsecurity - verifier output is not correlated with the validated signature References

["Claus Ibsen (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CAMEL-24444?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18120372#comment-18120372 ] 

Claus Ibsen commented on CAMEL-24444:
-------------------------------------

Merged follow-up PR: https://github.com/apache/camel/pull/27006

> camel-xmlsecurity - verifier output is not correlated with the validated signature References
> ---------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24444
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24444
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-xmlsecurity
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.23.0
>
>
> {{DefaultXmlSignature2Message.mapToMessage()}}, in the default (non-enveloping) branch:
> {code:java}
> // enveloped or detached XML signature  --> remove signature element
> node = input.getMessageBodyDocument().getDocumentElement();
> removeSignatureElements = true;
> {code}
> {{XmlVerifierProcessor.verify()}} validates every {{ds:Signature}} and then calls {{map2Message}}, which emits the entire document root minus the Signature elements. The validated References are available on {{Input}} precisely so the output can be restricted to what they covered, but the default mapper does not use them. The {{XmlSignatureChecker}} hook that exists to close this gap is {{null}} by default.
> So content that was never covered by any validated Reference is passed downstream indistinguishably from content that was. {{URI=""}} enveloped signatures are unaffected, because the Reference covers the whole document.
> Proposal: in the default branch, emit only the nodes covered by the validated References, or fail when the document contains content outside them. If that is too strict a default, at minimum ship a default {{XmlSignatureChecker}} that enforces the correlation and document the trade-off. Needs an upgrade-guide entry.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)