[
https://issues.apache.org/jira/browse/CAMEL-24444?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18107241#comment-18107241
]
Andrea Cosentino commented on CAMEL-24444:
------------------------------------------
Implementation note, because the proposal in the description turned out not to
be viable as written.
I first implemented the correlation as a default: in the non-enveloping branch
of {{DefaultXmlSignature2Message.mapToMessage()}}, require one of the validated
References to cover the document element, and fail otherwise. The rule was
already narrow - it only complained when the signature carried same-document
references and none of them covered the document element, leaving {{URI=""}}
and all-external-reference signatures alone.
That broke **7 existing tests**, all legitimate:
{{testDetachedSignature}}, {{testDetachedSignatureWitTransformHeader}},
{{testDetachedSignatureWrongXPathOrder}},
{{testDetachedSignatureComplexSchema}}, {{testSignatureIdAttribute}},
{{testSignatureIdAttributeGenerated}}, {{testSignatureIdAtributeNull}}.
{{testDetachedSignatureInternal}} signs {{<ns:root xmlns:ns="http://test";><a
ID="myID"><b>bValue</b></a></ns:root>}} with {{Reference URI="#myID"}} and
asserts the *whole payload* as the verified output. That is the pattern
documented under "Detached XML Signatures as Siblings of the Signed Elements":
a Reference deliberately covers a sub-element and the whole document is emitted
on purpose.
So the wrapping case and the documented detached case are structurally
identical - same-document Reference covering a sub-element, whole document
emitted - and nothing in the document distinguishes them. Only the route knows
which it intends, which means there is no safe default here.
What landed instead:
* {{DefaultXmlSignature2Message.setEnforceReferenceCoverage(boolean)}}, off by
default. When on, the default search requires a validated Reference to cover
the document element. Accepts an empty {{URI}}, {{#xpointer(/)}}, the document
element's own {{Id}}/{{ID}}/{{id}}, and the {{xpointer(id('x'))}} form; ignores
external references, which say nothing about the document either way.
* A new "Correlating the Verified Output with the Signed Content" section in
the verify component docs, explaining the gap and listing the three ways to
close it ({{enforceReferenceCoverage}}, {{outputNodeSearch}},
{{xmlSignatureChecker}}) with their trade-offs.
* Seven unit tests over the coverage rule, plus the existing 179 unchanged -
186 green.
It is a property on the mapper implementation rather than an endpoint option,
so there is no catalog or Endpoint DSL regeneration and it backports cleanly.
_Claude Code on behalf of oscerd_
> camel-xmlsecurity - verifier output is not correlated with the validated
> signature References
> ---------------------------------------------------------------------------------------------
>
> Key: CAMEL-24444
> URL: https://issues.apache.org/jira/browse/CAMEL-24444
> Project: Camel
> Issue Type: Bug
> Components: camel-xmlsecurity
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> {{DefaultXmlSignature2Message.mapToMessage()}}, in the default
> (non-enveloping) branch:
> {code:java}
> // enveloped or detached XML signature --> remove signature element
> node = input.getMessageBodyDocument().getDocumentElement();
> removeSignatureElements = true;
> {code}
> {{XmlVerifierProcessor.verify()}} validates every {{ds:Signature}} and then
> calls {{map2Message}}, which emits the entire document root minus the
> Signature elements. The validated References are available on {{Input}}
> precisely so the output can be restricted to what they covered, but the
> default mapper does not use them. The {{XmlSignatureChecker}} hook that
> exists to close this gap is {{null}} by default.
> So content that was never covered by any validated Reference is passed
> downstream indistinguishably from content that was. {{URI=""}} enveloped
> signatures are unaffected, because the Reference covers the whole document.
> Proposal: in the default branch, emit only the nodes covered by the validated
> References, or fail when the document contains content outside them. If that
> is too strict a default, at minimum ship a default {{XmlSignatureChecker}}
> that enforces the correlation and document the trade-off. Needs an
> upgrade-guide entry.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
