Re: [PR] XMLCipher refactor [santuario-xml-security-java ]

seanjmullan commented on code in PR #587:
URL: https://github.com/apache/santuario-xml-security-java/pull/587#discussion_r3235396199


##########
src/main/java/org/apache/xml/security/encryption/XMLCipher.java:
##########
@@ -1842,6 +1842,14 @@ public byte[] decryptToByteArray(Element element) throws XMLEncryptionException
         EncryptedData encryptedData = factory.newEncryptedData(element);
         String encMethodAlgorithm = encryptedData.getEncryptionMethod().getAlgorithm();
 
+        // Reject any attempt to decrypt with an algorithm that doesn't match the one specified when the XMLCipher was initialized
+        if (algorithm != null && !algorithm.equals(encMethodAlgorithm)) {

Review Comment:
   There are several other code paths that call `getEncryptionMethod().getAlgorithm()` - have you checked them for similar issues?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]