Skip to content
This repository has been archived by the owner on Jan 6, 2022. It is now read-only.

getStatus doesn't determine the S/MIME status correctly according to RFC #7

Open
bbottema opened this issue Apr 15, 2019 · 1 comment

Comments

@bbottema
Copy link

bbottema commented Apr 15, 2019

According to RFC 5751 (S/MIME 3.2), to determine if a message was signed or encrypted, the media type (primary-/sub type) value as well as its parameter smime-type should be taken into consideration:

3.2.2. The smime-type Parameter

 The application/pkcs7-mime content type defines the optional "smime-
 type" parameter.  The intent of this parameter is to convey details
 about the security applied (signed or enveloped) along with
 information about the contained content.

A little bit down an example is shown of a signed-only message:

A sample message would be:

  Content-Type: application/pkcs7-mime; smime-type=signed-data;name=smime.p7m

SmimeUtil doesn't look at smime-type at all when determining status and has resulted in incorrect status for a message of mine.

@bbottema
Copy link
Author

bbottema commented Jul 26, 2020

More specifically, it misses the case for enveloped S/MIME content. Here's the fixed code:

private static SmimeStateFixed getStatus(ContentType contentType) {
	if (isSmimeSignatureContentType(contentType)) {
		return SmimeStateFixed.SIGNED;
	} else if (isSignatureSmimeType(contentType)) {
		return SmimeStateFixed.SIGNED_ENVELOPED;
	} else if (isSmimeEncryptionContenttype(contentType)) {
		return SmimeStateFixed.ENCRYPTED;
	} else {
		return SmimeStateFixed.NEITHER;
	}
}

private static boolean isSignatureSmimeType(ContentType contentType) {
	String baseContentType = contentType.getBaseType();
	return baseContentType.equalsIgnoreCase("application/x-pkcs7-mime")
			&& "signed-data".equals(contentType.getParameter("smime-type"));
}

The caught exception in the original method is really problematic, hiding other possible errors that has nothing to do with S/MIME (like programming bugs).

bbottema added a commit to bbottema/java-utils-mail-smime-fork that referenced this issue Jul 26, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant