[jira] [Created] (CAMEL-24417) camel-as2 - asynchronous MDN delivery address is used without scheme validation and always over a plain socket

["Andrea Cosentino (Jira)" <ji...@apache.org>]

Andrea Cosentino created CAMEL-24417:
----------------------------------------

             Summary: camel-as2 - asynchronous MDN delivery address is used without scheme validation and always over a plain socket
                 Key: CAMEL-24417
                 URL: https://issues.apache.org/jira/browse/CAMEL-24417
             Project: Camel
          Issue Type: Bug
          Components: camel-as2
            Reporter: Andrea Cosentino
            Assignee: Andrea Cosentino
             Fix For: 4.23.0


When a received AS2 message carries a Receipt-Delivery-Option header, ResponseMDN (lines 202-207) stores its value as AS2AsynchronousMDNManager.RECIPIENT_ADDRESS, and AS2ServerConnection (lines 516-525) hands it to a new AS2AsynchronousMDNManager built with the connection's userName/password/accessToken.

AS2AsynchronousMDNManager.send() then does:

    URI uri = URI.create(recipientDeliveryAddress);
    ... connFactory.createConnection(new Socket(uri.getHost(), uri.getPort()))
    AS2HeaderUtils.addAuthorizationHeader(request, userName, password, accessToken);

Three problems:
1. The URI scheme is never checked, and the connection is a plain java.net.Socket - an https delivery address is still contacted in clear text.
2. There is no allow-list tying the delivery address to the configured partner.
3. AS2HeaderUtils.addAuthorizationHeader() attaches the configured Basic or Bearer credential unconditionally, whatever host was selected.

Proposal: validate the scheme, honour https by using the endpoint's SSLContextParameters, restrict delivery addresses to an operator-configured allow-list (empty = refuse asynchronous delivery to anything but the configured partner URL), and only attach credentials when the resolved host matches the configured partner. Also handle uri.getPort() == -1 rather than passing it to the Socket constructor.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)