Andrea Cosentino created CAMEL-24441:
----------------------------------------
Summary: camel-crypto-pgp - unmarshal accepts unsigned and
non-integrity-protected messages by default
Key: CAMEL-24441
URL: https://issues.apache.org/jira/browse/CAMEL-24441
Project: Camel
Issue Type: Bug
Components: camel-crypto
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.23.0
Two defaults in {{PGPKeyAccessDataFormat.unmarshal()}} (and the
{{PGPDataFormat}} subclass) let the incoming message decide whether it is
verified:
1. The MDC integrity check runs inside {{if (pbe.isIntegrityProtected())}}. A
message packaged as a legacy SED packet, which carries no MDC, skips the check
entirely. The {{integrity}} option (default {{true}}) governs *marshalling*
only - there is no decrypt-side equivalent that requires integrity protection
to be present.
2. {{signatureVerificationOption}} defaults to {{"optional"}}, so a message
carrying no signature skips verification altogether ({{verifySignature}} is a
no-op when there is nothing to verify).
The net effect is that the default decrypt path provides confidentiality but no
authenticity, and the sender of the message chooses which checks apply.
Proposal: add a decrypt-side option requiring integrity protection, and
consider defaulting {{signatureVerificationOption}} to {{"required"}} (or at
least {{"ifPresent"}} + require-integrity) in the next minor. Both are
behaviour changes and need upgrade-guide entries.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
