[backport camel-4.18.x] CAMEL-24417: camel-as2 - validate the asynchronous MDN delivery address and scope the MDN credentials - #25764
Merged
oscerd merged 1 commit intoAug 27, 2026
Conversation
…ss and scope the MDN credentials The delivery address for an asynchronous MDN comes from the Receipt-Delivery-Option header of the received AS2 message, so it is chosen by the sender. The server passed it straight to a socket and attached the configured MDN credentials to whatever host it named, with no scheme check. A new asyncMdnAllowedHosts option names the hosts an asynchronous MDN may be delivered to. Credentials are attached only for a host on the list, and an address naming a host outside it is refused. With the option unset the MDN is still delivered, as before, but no credentials are attached. Independently of the option the scheme must now be http. https is refused rather than attempted: this class delivers over a plain socket and has no TLS, so an https address wrote the request - including the Authorization header - in cleartext to the TLS port. IPv6 hosts are unbracketed before the allow-list match. Public API stays source and binary compatible; the previous constructors delegate. Real TLS delivery via SSLContextParameters is tracked as CAMEL-24474. Closes apache#25637 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
oscerd
added
the
backport
gnodet
approved these changes
Aug 26, 2026
gnodet
left a comment
gnodet
left a comment
Contributor
There was a problem hiding this comment.
Backport of #25637 (CAMEL-24417) onto camel-4.18.x. The security fix adds MDN delivery address validation and credential scoping for the AS2 component.
The conflict resolution is well-documented: HttpCore API differences on 4.18.x (e.g. httpContext.setAttribute vs setRequest) are handled correctly, and the upgrade guide entry is properly dropped. The new asyncMdnAllowedHosts parameter and generated catalog changes are consistent.
CI green on JDK 17 and 21.
AI-generated review on behalf of Guillaume Nodet. Feedback? Let us know!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #25637
Cherry-pick of #25637 onto
camel-4.18.x.Original PR: #25637
Original author: @oscerd
Resolution notes: the 4.23 upgrade-guide entry is dropped (guides for all lines live on
main). On 4.18.x the HttpCore API differs, sohttpContext.setRequest(request)is kept assetAttribute(HttpCoreContext.HTTP_REQUEST, request). The four auth tests each mixed this change with an unrelatedmain-only dynamic-port change; the allow-list part is taken and the branch'sTARGET_PORTconstant kept. Generated files were regenerated by a full reactor build.Verified: cherry-pick applied with the conflicts resolved as above, and the branch builds on
camel-4.18.x.Claude Code on behalf of oscerd