davsclaus opened a new pull request, #25870:
URL: https://github.com/apache/camel/pull/25870

   ## Backport of #25641
   
   Cherry-pick of #25641 onto `camel-4.18.x`.
   
   **Original PR:** #25641 - CAMEL-24429: camel-as2 - confine per-request 
signing keys to the request in ResponseMDN
   **Original author:** @oscerd
   **Target branch:** `camel-4.18.x`
   
   ### Original description
   
   ResponseMDN held the AS2 security material in mutable instance fields and 
overwrote them per request when the keys are dynamic. A single ResponseMDN is 
registered on the shared HttpProcessor and serves every request; the assignment 
block was not covered by the class's lock, and the values stayed in place after 
the request that set them. A deployment hosting several partners on different 
paths, each with its own keys, could therefore sign one partner's MDN with 
another partner's private key, or validate against the wrong chain.
   
   process() now resolves the five values into locals for the duration of the 
call; the fields and keysAreDynamic are now final as a regression guard. See 
original PR for full details.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to