gnodet-bot commented on code in PR #26726:
URL: https://github.com/apache/camel/pull/26726#discussion_r4092565846
##########
components/camel-xmlsecurity/src/test/java/org/apache/camel/component/xmlsecurity/XmlSignatureTest.java:
##########
@@ -382,6 +387,41 @@ public void configure() {
};
}
+ RouteBuilder createEnforceReferenceCoverageRoute() {
+ return new RouteBuilder() {
+ public void configure() {
+
onException(XmlSignatureException.class).handled(true).to("mock:enforceCoverageException");
+ from("direct:enforceCoverage")
+
.to("xmlsecurity-sign:enforceCoverage?keyAccessor=#keyAccessorDefault"
+ + "&xpathsToIdAttributes=#xpathsToIdAttributes"
+ +
"&schemaResourceUri=org/apache/camel/component/xmlsecurity/Test.xsd&signatureId=&clearHeaders=false")
+
.to("xmlsecurity-verify:enforceCoverage?keySelector=#keySelectorDefault"
+ +
"&schemaResourceUri=org/apache/camel/component/xmlsecurity/Test.xsd"
+ + "&xmlSignature2Message=#enforceCoverageMapper")
+ .to("mock:enforceCoverageResult");
+ }
+ };
+ }
+
+ @Test
+ void enforceReferenceCoverageRejectsASignatureCoveringOnlyASubElement()
throws Exception {
+ // a detached signature legitimately covers a sub-element while the
whole document is emitted - the same shape
+ // as an XML signature wrapping attack. With enforceReferenceCoverage
on, the default output-node search must
+ // refuse to emit the uncovered document element. This drives the
check through mapToMessage, not in isolation.
+ String detachedPayload = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
+ + "<ns:root xmlns:ns=\"http://test\";><a
ID=\"myID\"><b>bValue</b></a></ns:root>";
+
+ MockEndpoint exceptionMock =
getMockEndpoint("mock:enforceCoverageException");
+ exceptionMock.expectedMessageCount(1);
+ MockEndpoint resultMock =
getMockEndpoint("mock:enforceCoverageResult");
+ resultMock.expectedMessageCount(0);
+
+ TestSupport.sendBody(this.template, "direct:enforceCoverage",
detachedPayload,
+
Collections.singletonMap(XmlSignatureConstants.HEADER_CONTENT_REFERENCE_URI,
(Object) "#myID"));
+
+ MockEndpoint.assertIsSatisfied(context);
+ }
Review Comment:
🟠**Integration test only covers the rejection path — the happy-path
acceptance is untested end-to-end.**
`enforceReferenceCoverageRejectsASignatureCoveringOnlyASubElement` proves
that a sub-element reference causes rejection. It does not prove that a
signature whose reference covers the document element is accepted through the
full sign→verify→mapToMessage pipeline.
The unit tests in `DefaultXmlSignature2MessageReferenceCoverageTest` cover
the acceptance logic (e.g. `anEmptyReferenceUriCoversTheWholeDocument`,
`aReferenceToTheDocumentElementsOwnIdIsAccepted`) but those use stub
`Input`/`Reference` objects. A regression that e.g. inverted the `if
(enforceReferenceCoverage)` guard but kept the call wired would still pass all
current tests.
Add one test that sends an enveloped-style payload where `URI=""` covers the
whole document, with `enforceReferenceCoverage=true`, and asserts that
`mock:enforceCoverageResult` receives a message (i.e. the route completes
normally). The existing route already handles this — it just needs a test
sending a payload with a whole-document reference.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
