oscerd opened a new pull request, #26726: URL: https://github.com/apache/camel/pull/26726
This fixes [CAMEL-24444](https://issues.apache.org/jira/browse/CAMEL-24444). Core XML-signature validation proves only that each `Reference`'s digest matches the content that Reference resolves to — not that the node the route ultimately consumes is covered by any signature. For an enveloped or detached signature handled by the default output-node search, an attacker can therefore present a document where a valid `Reference` covers a sub-element while the whole (unsigned) document element is what gets emitted onto the route: XML Signature Wrapping. A new opt-in `enforceReferenceCoverage` on `DefaultXmlSignature2Message` (default off) requires that one of the validated References cover the document element being emitted, otherwise verification fails. It is off by default because the legitimate detached-signature flow — a Reference deliberately covering a sub-element with the whole document emitted on output — would otherwise break; a deployment that wants the guarantee enables it, or supplies a custom output-node search / `XmlSignatureChecker` when the default search does not fit. **Test:** `DefaultXmlSignature2MessageReferenceCoverageTest` covers the covered and uncovered cases with the option both on and off. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
