Fix mdn body part extraction (#282)

* Remove unused import * Fix extracting MDN mimebodypart * Fix zip bomb * Release notes Co-authored-by: chrisbroderick <chrisbroderick@christophersmbp>
OpenAS2 · Jul 5, 2022 · 1475298 · 1475298
1 parent 3e53e1a
commit 1475298
Show file tree

Hide file tree

Showing 7 changed files with 21 additions and 14 deletions.
diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md
@@ -1,20 +1,20 @@
 #              OpenAS2 Server
-#              Version 3.2.0
+#              Version 3.2.1
 #              RELEASE NOTES
 -----
-The OpenAS2 project is pleased to announce the release of OpenAS2 3.2.0
+The OpenAS2 project is pleased to announce the release of OpenAS2 3.2.1
 
-The release download file is: OpenAS2Server-3.2.0.zip
+The release download file is: OpenAS2Server-3.2.1.zip
 
 The zip file contains a PDF document (OpenAS2HowTo.pdf) providing information on installing and using the application.
 ## NOTE: Testing covers Java 8 to 17. The application should work for older versions down to Java 7 but they are not tested as part of the CI/CD pipeline.
 
-Version 3.2.0 - 2022-06-21
+Version 3.2.1 - 2022-07-06
 This is a minor enhancement and bugfix release:
        **IMPORTANT NOTE**: Please review upgrade notes below if you are upgrading
 
-  1. Support "prevent_chunking" attribute on partnership to support older AS2 systems.
-  2. Fix copying the sent file to the sent folder when successfully sent.
+  1. Fix extracting the MDN bodypart from the multipart.
+  2. Fix creating a zip bomb package.
 
 
 ##Upgrade Notes

diff --git a/Remote/pom.xml b/Remote/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>net.sf.openas2</groupId>
         <artifactId>OpenAS2</artifactId>
-        <version>3.2.0</version>
+        <version>3.2.1</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/Server/pom.xml b/Server/pom.xml
@@ -7,7 +7,7 @@
         <!-- DO NOT CHANGE THIS "groupId" WITHOUT CHANGING XMLSession.getManifestAttributes.MANIFEST_VENDOR_ID_ATTRIB -->
         <groupId>net.sf.openas2</groupId>
         <artifactId>OpenAS2</artifactId>
-        <version>3.2.0</version>
+        <version>3.2.1</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
@@ -100,10 +100,11 @@
                                 <!-- Add the remote jar for connecting to the server command interface -->
                                 <copy file="${remote.connect.jar}"
                                       todir="${package.assembly.dir}/bin/remote" verbose="true"/>
-                                <!-- create distribution package -->
+                                <!-- create distribution package
+                                    basedir="${package.assembly.dir}"
+ -->
                                 <zip
                                     destfile="${project.basedir}/dist/${project.dist.package.name}"
-                                    basedir="${package.assembly.dir}"
                                     update="true">
                                         <zipfileset dir="${package.assembly.dir}" encoding="UTF-8"
                                                  includes="**/*.sh" filemode="755"/>

diff --git a/Server/src/main/java/org/openas2/processor/sender/AS2SenderModule.java b/Server/src/main/java/org/openas2/processor/sender/AS2SenderModule.java
@@ -39,7 +39,6 @@
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
-import java.io.InputStream;
 import java.io.ObjectOutputStream;
 import java.net.HttpURLConnection;
 import java.net.URL;

diff --git a/Server/src/main/java/org/openas2/util/AS2Util.java b/Server/src/main/java/org/openas2/util/AS2Util.java
@@ -104,7 +104,7 @@ public static void parseMDN(Message msg, X509Certificate receiver) throws OpenAS
         }
 
         try {
-            MimeMultipart reportParts = (MimeMultipart)mainPart.getContent();
+            MimeMultipart reportParts = new MimeMultipart(mainPart.getDataHandler().getDataSource());
 
             if (reportParts != null) {
                 ContentType reportType = new ContentType(reportParts.getContentType());

diff --git a/changes.txt b/changes.txt
@@ -1,3 +1,10 @@
+Version 3.2.1 - 2022-07-06
+This is a bugfix release:
+       **IMPORTANT NOTE**: Please review upgrade notes in the RELEASE-NOTES.md if you are upgrading
+
+  1. Fix extracting the MDN bodypart from the multipart.
+  2. Fix creating a zip bomb package.
+
 Version 3.2.0 - 2022-06-21
 This is a minor enhancement and bugfix release:
        **IMPORTANT NOTE**: Please review upgrade notes in the RELEASE-NOTES.md if you are upgrading

diff --git a/pom.xml b/pom.xml
@@ -5,7 +5,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>net.sf.openas2</groupId>
     <artifactId>OpenAS2</artifactId>
-    <version>3.2.0</version>
+    <version>3.2.1</version>
     <name>OpenAS2</name>
     <packaging>pom</packaging>
 
@@ -196,7 +196,7 @@
             <dependency>
                 <groupId>io.sentry</groupId>
                 <artifactId>sentry</artifactId>
-                <version>6.1.2</version>
+                <version>6.1.4</version>
             </dependency>
         </dependencies>
     </dependencyManagement>