Andrea Cosentino created CAMEL-24431:
----------------------------------------
Summary: camel-as2 - bound the expansion of compressed entities
before they are verified
Key: CAMEL-24431
URL: https://issues.apache.org/jira/browse/CAMEL-24431
Project: Camel
Issue Type: Improvement
Components: camel-as2
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.23.0
HttpMessageUtils.extractEdiPayloadFromCompressedEntity() expands a compressed
AS2 entity with no limit:
{code:java}
MimeEntity entity = compressedDataEntity.getCompressedEntity(new
ZlibExpanderProvider());
{code}
ZlibExpanderProvider has a constructor taking an expansion limit; the no-arg
form is unbounded. The expansion happens while extracting the payload, before
the signature has been established, so the work is done on behalf of an
unauthenticated sender and is disproportionate to the wire size (zlib reaches
roughly 1000:1).
Proposal: use ZlibExpanderProvider(limit) with an operator-configurable cap,
defaulting to something appropriate for AS2 payloads, and fail the exchange
cleanly when the limit is hit. Worth pairing with the ordering question -
whether extraction should happen before or after signature verification at all.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
