gnodet-bot commented on code in PR #26725:
URL: https://github.com/apache/camel/pull/26725#discussion_r4091447424
##########
components/camel-crypto/src/main/java/org/apache/camel/converter/crypto/CryptoDataFormat.java:
##########
@@ -247,6 +293,31 @@ public byte[] getCalculatedMac() {
};
}
+ /**
+ * A fresh initialization vector, sized to the cipher's block length. Only
used when the vector is inlined into the
+ * message, so the reader takes it from the stream and nothing needs to be
shared out of band.
+ */
+ private byte[] generateInitializationVector() throws Exception {
+ byte[] iv = new byte[getCipherBlockSize()];
+ SECURE_RANDOM.nextBytes(iv);
+ return iv;
+ }
+
+ private int getCipherBlockSize() throws Exception {
+ int blockSize = cachedBlockSize;
+ if (blockSize == 0) {
+ Cipher cipher
+ = cryptoProvider == null ? Cipher.getInstance(algorithm) :
Cipher.getInstance(algorithm, cryptoProvider);
+ blockSize = cipher.getBlockSize();
+ if (blockSize <= 0) {
+ // A stream cipher reports no block size; 16 bytes is the
usual nonce length
+ blockSize = 16;
+ }
+ cachedBlockSize = blockSize;
Review Comment:
🔵 **`cachedBlockSize` goes stale if `setAlgorithm` or `setCryptoProvider` is
called after the first marshal.**
`setAlgorithm(String)` (~line 386) does not reset `cachedBlockSize`. If a
route changes the algorithm from `DES/CBC/PKCS5Padding` (block size 8) to
`AES/CBC/PKCS5Padding` (block size 16) after the first marshal, the cached
value stays 8 and subsequent marshals generate 8-byte IVs for AES →
`InvalidAlgorithmParameterException: wrong IV length`.
Davsclaus flagged this as 🔵. The fix is to reset `cachedBlockSize = 0` in
both `setAlgorithm` and `setCryptoProvider` after the field assignment. The
current lazy-init pattern in `getCipherBlockSize()` is correct otherwise — it
just needs cache invalidation on reconfiguration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
