Dhairya-007 opened a new pull request, #29707:
URL: https://github.com/apache/camel/pull/29707
## Problem
`DigitalSignatureConfiguration` has five "reference name" options that look
an object up in the registry and apply it if the lookup found one. Four of them
guard on **the value they just looked up**:
```java
public void setKeystoreName(String keystoreName) {
if (context != null && keystoreName != null) {
KeyStore keystore =
context.getRegistry().lookupByNameAndType(keystoreName, KeyStore.class);
if (keystore != null) {
setKeystore(keystore);
}
}
...
```
`setPublicKeyName`, `setPrivateKeyName` and `setCertificateName` are the
same shape, each guarding on its own local (`pk`, `pk`, `certificate`).
`setSecureRandomName` copied that guard, but its local is called `random` —
so `keystore` in the condition is **the field**, which has nothing to do with
the lookup:
```java
public void setSecureRandomName(String randomName) {
if (context != null && randomName != null) {
SecureRandom random =
context.getRegistry().lookupByNameAndType(randomName, SecureRandom.class);
if (keystore != null) { // the field, not the value just
looked up
setSecureRandom(random);
}
}
...
```
Two consequences:
- **`secureRandomName` is silently ignored unless a `KeyStore` object is
already set** on the configuration. Signing or verifying with a plain
`privateKey`/`publicKey`, which is what the component's own tests do, never
sets one, so the `SecureRandom` the user named is resolved and then dropped,
and the `Signature` is initialised without it.
- When a keystore *is* set and the name resolves to nothing, the condition
is true anyway and `setSecureRandom(null)` **wipes** a `SecureRandom` that was
configured directly through `secureRandom`.
`setCamelContext` re-runs all five setters once the context is known, so the
bug does not depend on the order the options are set in — it is not reachable
at all without a keystore.
## Fix
Guard on `random`, like the four siblings.
## Tests
New `DigitalSignatureConfigurationTest`:
- `secureRandomNameShouldResolveWithoutAKeystore` — the named `SecureRandom`
is used when no keystore is configured. Fails on `main`.
- `secureRandomNameShouldResolveTheSameWayAsTheOtherReferenceNames` — the
name set before the context is known is resolved by `setCamelContext`, as the
other reference names are. Fails on `main`.
- `anUnknownSecureRandomNameShouldNotClearTheConfiguredOne` — a name that
resolves to nothing leaves a directly configured `SecureRandom` alone. This is
the second half of the bug; it passes either way without a keystore, and pins
the behaviour.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
