oscerd opened a new pull request, #25848: URL: https://github.com/apache/camel/pull/25848
Fixes [CAMEL-24441](https://issues.apache.org/jira/browse/CAMEL-24441). unmarshal() verified the modification detection code only when the message was an OpenPGP symmetrically encrypted integrity protected data packet: if (pbe.isIntegrityProtected()) { if (!pbe.verify()) { throw new PGPException("Message failed integrity check"); } } The older symmetrically encrypted data packet carries no such code, and OpenPGP's CFB mode is malleable without one, so a message using that packet skipped the check altogether. The packet type is chosen by whoever produced the message, which left the sender - or anyone able to rewrite the message in transit - deciding whether the check applied. The existing integrity option governs marshalling only and has no decrypt-side counterpart. Add requireIntegrityProtection, defaulting to true, which rejects a message that is not integrity protected. Routes interoperating with a sender that still emits the legacy packet must set it to false. signatureVerificationOption still defaults to optional, so a message carrying no signature is accepted. Flipping that would reject every unsigned message and is a separate decision; the upgrade guide points at it, since the two options together are what give a decrypted message authenticity and not only confidentiality. PGPDataFormatTest sets encryptor.setIntegrity(false) for its whole class, so its decryptor now opts out explicitly - the same change an affected deployment makes. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> ## Verification Full `mvn clean install -DskipTests` green across the reactor; generated files regenerated and committed. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
