Spring/spring-ws
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polishing.

Browse Source 
Related: #1300.
This commit is contained in:
Greg L. Turnquist
2023-01-25 12:57:24 -06:00
parent bd7ba3be41
commit 7ae57b583e
3 changed files with 79 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java
View File

@@ -136,6 +136,7 @@ import org.w3c.dom.Element;
* @author Arjen Poutsma
* @author Greg Turnquist
* @author Jamin Hitchcock
* @author Rob Leland
* @see <a href="http://ws.apache.org/wss4j/">Apache WSS4J 2.0</a>
* @since 2.3.0
*/
@@ -406,6 +407,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/** Sets the time to live on the outgoing message */
public void setSecurementTimeToLive(int securementTimeToLive) {
if (securementTimeToLive <= 0) {
throw new IllegalArgumentException("timeToLive must be positive");
}
@@ -430,6 +432,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/** Sets the server-side time to live */
public void setValidationTimeToLive(int validationTimeToLive) {
if (validationTimeToLive <= 0) {
throw new IllegalArgumentException("timeToLive must be positive");
}
@@ -438,6 +441,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/** Sets the validation actions to be executed by the interceptor. */
public void setValidationActions(String actions) {
this.validationActions = actions;
try {
validationActionsVector = WSSecurityUtil.decodeAction(actions);
@@ -451,7 +455,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Sets the {@link org.apache.ws.security.WSPasswordCallback} handler to use when validating messages.
* Sets the {@link CallbackHandler} to use when validating messages.
*
* @see #setValidationCallbackHandlers(CallbackHandler[])
*/
@@ -460,7 +464,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Sets the {@link org.apache.ws.security.WSPasswordCallback} handlers to use when validating messages.
* Sets the {@link CallbackHandler}s to use when validating messages.
*
* @see #setValidationCallbackHandler(CallbackHandler)
*/
@@ -480,6 +484,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/** Whether to enable signatureConfirmation or not. By default signatureConfirmation is enabled */
public void setEnableSignatureConfirmation(boolean enableSignatureConfirmation) {
handler.setOption(WSHandlerConstants.ENABLE_SIGNATURE_CONFIRMATION, enableSignatureConfirmation);
this.enableSignatureConfirmation = enableSignatureConfirmation;
}
@@ -523,6 +528,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
* @param config web service security configuration or {@code null} to use default settings
*/
public void setWssConfig(WSSConfig config) {
securityEngine.setWssConfig(config);
wssConfig = config;
}
@@ -538,15 +544,17 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
* Set the WS-I Basic Security Profile compliance mode. Default is {@code true}.
*/
public void setBspCompliant(boolean bspCompliant) {
this.handler.setOption(WSHandlerConstants.IS_BSP_COMPLIANT, bspCompliant);
this.bspCompliant = bspCompliant;
}
/**
* Sets whether to add an InclusiveNamespaces PrefixList as a CanonicalizationMethod child
* when generating Signatures using WSConstants.C14N_EXCL_OMIT_COMMENTS. Default is {@code true}.
* Sets whether to add an InclusiveNamespaces PrefixList as a CanonicalizationMethod child when generating Signatures
* using WSConstants.C14N_EXCL_OMIT_COMMENTS. Default is {@code true}.
*/
public void setAddInclusivePrefixes(boolean addInclusivePrefixes) {
this.handler.setOption(WSHandlerConstants.ADD_INCLUSIVE_PREFIXES, addInclusivePrefixes);
this.addInclusivePrefixes = addInclusivePrefixes;
}
@@ -563,6 +571,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
* is 60 seconds.
*/
public void setFutureTimeToLive(int futureTimeToLive) {
if (futureTimeToLive <= 0) {
throw new IllegalArgumentException("futureTimeToLive must be positive");
}
@@ -579,6 +588,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
@Override
public void afterPropertiesSet() throws Exception {
Assert.isTrue(validationActions != null || securementActions != null,
"validationActions or securementActions are required");
if (validationActions != null) {
@@ -592,7 +602,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
// securement actions are not to be validated at start up as they could
// be configured dynamically via the message context
}
@Override
@@ -631,6 +640,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
* @return the request data
*/
protected RequestData initializeRequestData(MessageContext messageContext) {
RequestData requestData = new RequestData();
requestData.setMsgContext(messageContext);
@@ -667,6 +677,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
* @return the request data
*/
protected RequestData initializeValidationRequestData(MessageContext messageContext) {
RequestData requestData = new RequestData();
requestData.setMsgContext(messageContext);
@@ -696,6 +707,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
@Override
protected void validateMessage(SoapMessage soapMessage, MessageContext messageContext)
throws WsSecurityValidationException {
if (logger.isDebugEnabled()) {
logger.debug("Validating message [" + soapMessage + "] with actions [" + validationActions + "]");
}
@@ -756,6 +768,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
*/
protected void checkResults(List<WSSecurityEngineResult> results, List<Integer> validationActions)
throws Wss4jSecurityValidationException {
if (!handler.checkReceiverResultsAnyOrder(results, validationActions)) {
throw new Wss4jSecurityValidationException("Security processing failed (actions mismatch)");
}
@@ -767,6 +780,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
*/
@SuppressWarnings("unchecked")
private void updateContextWithResults(MessageContext messageContext, List<WSSecurityEngineResult> results) {
List<WSHandlerResult> handlerResults;
if ((handlerResults = (List<WSHandlerResult>) messageContext
.getProperty(WSHandlerConstants.RECV_RESULTS)) == null) {
@@ -785,6 +799,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
* @param result
*/
protected void verifyCertificateTrust(WSHandlerResult result) throws WSSecurityException {
List<WSSecurityEngineResult> results = result.getActionResults().get(WSConstants.SIGN);
if (!CollectionUtils.isEmpty(results)) {
@@ -808,6 +823,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
* @param result
*/
protected void verifyTimestamp(WSHandlerResult result) throws WSSecurityException {
List<WSSecurityEngineResult> results = result.getActionResults().get(WSConstants.TS);
if (!CollectionUtils.isEmpty(results)) {
@@ -830,6 +846,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
private void processPrincipal(WSHandlerResult result) {
List<WSSecurityEngineResult> results = result.getActionResults().get(WSConstants.UT);
if (!CollectionUtils.isEmpty(results)) {
@@ -851,6 +868,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
@Override
protected void cleanUp() {
if (validationCallbackHandler != null) {
try {
CleanupCallback cleanupCallback = new CleanupCallback();

3
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/SaajWss4jMessageInterceptorSignTest.java
View File

@@ -97,7 +97,8 @@ public class SaajWss4jMessageInterceptorSignTest extends Wss4jMessageInterceptor
SOAPMessage saajMessage = saajSoap11MessageFactory.createMessage();
transformer.transform(new StringSource(PAYLOAD), new DOMResult(saajMessage.getSOAPBody()));
SoapMessage message = new SaajSoapMessage(saajMessage, saajSoap11MessageFactory);
MessageContext messageContext = new DefaultMessageContext(message, new SaajSoapMessageFactory(saajSoap11MessageFactory));
MessageContext messageContext = new DefaultMessageContext(message,
new SaajSoapMessageFactory(saajSoap11MessageFactory));
interceptor.secureMessage(message, messageContext);

96
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/SaajWss4jSecurityInterceptorDefaultsTest.java
View File

@@ -16,6 +16,17 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.springframework.test.util.AssertionErrors.assertEquals;
import jakarta.xml.soap.SOAPException;
import jakarta.xml.soap.SOAPMessage;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerException;
import javax.xml.transform.dom.DOMResult;
import org.apache.wss4j.dom.handler.RequestData;
import org.junit.jupiter.api.Test;
import org.springframework.test.util.ReflectionTestUtils;
@@ -27,57 +38,58 @@ import org.springframework.ws.soap.saaj.SaajSoapMessageFactory;
import org.springframework.xml.transform.StringSource;
import org.springframework.xml.transform.TransformerFactoryUtils;
import jakarta.xml.soap.SOAPException;
import jakarta.xml.soap.SOAPMessage;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerException;
import javax.xml.transform.dom.DOMResult;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.springframework.test.util.AssertionErrors.assertEquals;
public class SaajWss4jSecurityInterceptorDefaultsTest extends Wss4jTestCase {
private static final String PAYLOAD = "<tru:StockSymbol xmlns:tru=\"http://fabrikam123.com/payloads\">QQQ</tru:StockSymbol>";
private static final String PAYLOAD = "<tru:StockSymbol xmlns:tru=\"http://fabrikam123.com/payloads\">QQQ</tru:StockSymbol>";
@Test
public void testThatTheDefaultValueForAddInclusivePrefixesMatchesWss4JDefaultValue() {
Wss4jSecurityInterceptor subject = new Wss4jSecurityInterceptor();
RequestData requestData = new RequestData();
Boolean springDefault = (Boolean) ReflectionTestUtils.getField(subject, Wss4jSecurityInterceptor.class, "addInclusivePrefixes");
assertEquals("Spring-ws default for addInclusivePrefixes matches Wss4j default", requestData.isAddInclusivePrefixes(), springDefault);
}
@Test
public void testThatTheDefaultValueForAddInclusivePrefixesMatchesWss4JDefaultValue() {
@Test
public void testThatInitializeValidationRequestDataSetsInclusivePrefixesUsingDefaults() throws TransformerException, SOAPException {
Wss4jSecurityInterceptor subject = new Wss4jSecurityInterceptor();
Wss4jSecurityInterceptor subject = new Wss4jSecurityInterceptor();
RequestData requestData = new RequestData();
Boolean springDefault = (Boolean) ReflectionTestUtils.getField(subject, Wss4jSecurityInterceptor.class,
"addInclusivePrefixes");
assertEquals("Spring-ws default for addInclusivePrefixes matches Wss4j default",
requestData.isAddInclusivePrefixes(), springDefault);
}
Transformer transformer = TransformerFactoryUtils.newInstance().newTransformer();
@Test
public void testThatInitializeValidationRequestDataSetsInclusivePrefixesUsingDefaults()
throws TransformerException, SOAPException {
SOAPMessage saajMessage = saajSoap11MessageFactory.createMessage();
transformer.transform(new StringSource(PAYLOAD), new DOMResult(saajMessage.getSOAPBody()));
SoapMessage message = new SaajSoapMessage(saajMessage, saajSoap11MessageFactory);
MessageContext messageContext = new DefaultMessageContext(message, new SaajSoapMessageFactory(saajSoap11MessageFactory));
Wss4jSecurityInterceptor subject = new Wss4jSecurityInterceptor();
RequestData validationData = ReflectionTestUtils.invokeMethod(subject, "initializeValidationRequestData", messageContext);
Transformer transformer = TransformerFactoryUtils.newInstance().newTransformer();
assertTrue(validationData.isAddInclusivePrefixes());
}
SOAPMessage saajMessage = saajSoap11MessageFactory.createMessage();
transformer.transform(new StringSource(PAYLOAD), new DOMResult(saajMessage.getSOAPBody()));
SoapMessage message = new SaajSoapMessage(saajMessage, saajSoap11MessageFactory);
MessageContext messageContext = new DefaultMessageContext(message,
new SaajSoapMessageFactory(saajSoap11MessageFactory));
@Test
public void testThatInitializeValidationRequestDataSetsInclusivePrefixesUsingNotUsingInclusivePrefixes() throws TransformerException, SOAPException {
Wss4jSecurityInterceptor subject = new Wss4jSecurityInterceptor();
subject.setAddInclusivePrefixes(false);
Transformer transformer = TransformerFactoryUtils.newInstance().newTransformer();
RequestData validationData = ReflectionTestUtils.invokeMethod(subject, "initializeValidationRequestData",
messageContext);
SOAPMessage saajMessage = saajSoap11MessageFactory.createMessage();
transformer.transform(new StringSource(PAYLOAD), new DOMResult(saajMessage.getSOAPBody()));
SoapMessage message = new SaajSoapMessage(saajMessage, saajSoap11MessageFactory);
MessageContext messageContext = new DefaultMessageContext(message, new SaajSoapMessageFactory(saajSoap11MessageFactory));
assertTrue(validationData.isAddInclusivePrefixes());
}
RequestData validationData = ReflectionTestUtils.invokeMethod(subject, "initializeValidationRequestData", messageContext);
@Test
public void testThatInitializeValidationRequestDataSetsInclusivePrefixesUsingNotUsingInclusivePrefixes()
throws TransformerException, SOAPException {
assertFalse(validationData.isAddInclusivePrefixes());
}
}
Wss4jSecurityInterceptor subject = new Wss4jSecurityInterceptor();
subject.setAddInclusivePrefixes(false);
Transformer transformer = TransformerFactoryUtils.newInstance().newTransformer();
SOAPMessage saajMessage = saajSoap11MessageFactory.createMessage();
transformer.transform(new StringSource(PAYLOAD), new DOMResult(saajMessage.getSOAPBody()));
SoapMessage message = new SaajSoapMessage(saajMessage, saajSoap11MessageFactory);
MessageContext messageContext = new DefaultMessageContext(message,
new SaajSoapMessageFactory(saajSoap11MessageFactory));
RequestData validationData = ReflectionTestUtils.invokeMethod(subject, "initializeValidationRequestData",
messageContext);
assertFalse(validationData.isAddInclusivePrefixes());
}
}