[CAMEL-18917] camel-as2 - Signature is not validated

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 3.21.0, 4.0.0
• Component/s: camel-as2
• Estimated Complexity: Unknown
• Assignee: Unassigned
• Reporter: dennis lucero
• Created: 13/Jan/23 15:02
• Updated: 10/Aug/23 07:27
• Resolved: 10/Aug/23 07:26

Description

org.apache.camel.component.as2.api.entity.EntityParser can parse SIGNED requests into org.apache.camel.component.as2.api.entity.MultipartSignedEntity.

But the signature part is completely ignored and never validated.

Is this intentional? Whats the point of having a signature that is never validated.

I'm wondering, because MultipartSignedEntity has a method "isValid" that is only used in the unit tests, not during request handling.

Also I've recognized, that the "isValid" method does the validation wrong.

To my knowledge one should check if the signatures certificate is contained in the certificates configured on the endpoint and then verify the signature against this. But in fact, the method validates the request-signature against the certificate provided within the signature. So currently the signature would be always valid.

Issue Links

• is related to: CAMEL-18017 camel-as2 - Signed content in MDN gets corrupted and is not possible to validate
• links to: GitHub Pull Request #9219