Re: [PR] XMLCipher refactor [santuario-xml-security-java ]

coheigea commented on code in PR #587:
URL: https://github.com/apache/santuario-xml-security-java/pull/587#discussion_r3260489130


##########
src/main/java/org/apache/xml/security/encryption/XMLCipher.java:
##########
@@ -1842,6 +1842,14 @@ public byte[] decryptToByteArray(Element element) throws XMLEncryptionException
         EncryptedData encryptedData = factory.newEncryptedData(element);
         String encMethodAlgorithm = encryptedData.getEncryptionMethod().getAlgorithm();
 
+        // Reject any attempt to decrypt with an algorithm that doesn't match the one specified when the XMLCipher was initialized
+        if (algorithm != null && !algorithm.equals(encMethodAlgorithm)) {

Review Comment:
   @seanjmullan Good catch, there was a similar issue for the key wrap algorithm that I updated in the PR. We use a different approach for streaming so it doesn't apply there.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]