[
https://issues.apache.org/jira/browse/CAMEL-24431?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-24431 started by Andrea Cosentino.
------------------------------------------------
> camel-as2 - bound the expansion of compressed entities before they are
> verified
> -------------------------------------------------------------------------------
>
> Key: CAMEL-24431
> URL: https://issues.apache.org/jira/browse/CAMEL-24431
> Project: Camel
> Issue Type: Improvement
> Components: camel-as2
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> HttpMessageUtils.extractEdiPayloadFromCompressedEntity() expands a compressed
> AS2 entity with no limit:
> {code:java}
> MimeEntity entity = compressedDataEntity.getCompressedEntity(new
> ZlibExpanderProvider());
> {code}
> ZlibExpanderProvider has a constructor taking an expansion limit; the no-arg
> form is unbounded. The expansion happens while extracting the payload, before
> the signature has been established, so the work is done on behalf of an
> unauthenticated sender and is disproportionate to the wire size (zlib reaches
> roughly 1000:1).
> Proposal: use ZlibExpanderProvider(limit) with an operator-configurable cap,
> defaulting to something appropriate for AS2 payloads, and fail the exchange
> cleanly when the limit is hit. Worth pairing with the ordering question -
> whether extraction should happen before or after signature verification at
> all.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
