Spring/spring-ws
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SWS-448

Browse Source
This commit is contained in:
Arjen Poutsma
2008-11-18 10:02:27 +00:00
parent e2e94566a8
commit f2d7d60850
3 changed files with 33 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java
View File

@@ -45,6 +45,7 @@ import org.w3c.dom.Document;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.util.Assert;
import org.springframework.util.CollectionUtils;
import org.springframework.util.StringUtils;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
@@ -495,11 +496,12 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
WSSecurityEngine securityEngine = WSSecurityEngine.getInstance();
try {
Vector results = securityEngine.processSecurityHeader(envelopeAsDocument, validationActor,
validationCallbackHandler, validationSignatureCrypto, validationDecryptionCrypto);
Vector results = securityEngine
.processSecurityHeader(envelopeAsDocument, validationActor, validationCallbackHandler,
validationSignatureCrypto, validationDecryptionCrypto);
// Results verification
if (results == null) {
if (CollectionUtils.isEmpty(results)) {
throw new Wss4jSecurityValidationException("No WS-Security header found");
}
@@ -532,8 +534,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
*/
private void updateContextWithResults(MessageContext messageContext, Vector results) {
Vector handlerResults;
if ((handlerResults = (Vector) messageContext
.getProperty(WSHandlerConstants.RECV_RESULTS)) == null) {
if ((handlerResults = (Vector) messageContext.getProperty(WSHandlerConstants.RECV_RESULTS)) == null) {
handlerResults = new Vector();
messageContext.setProperty(WSHandlerConstants.RECV_RESULTS, handlerResults);
}
@@ -549,8 +550,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
WSSecurityEngineResult actionResult = WSSecurityUtil.fetchActionResult(results, WSConstants.SIGN);
if (actionResult != null) {
X509Certificate returnCert =
(X509Certificate) actionResult.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE);
X509Certificate returnCert = (X509Certificate) actionResult.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE)
;
if (!handler.verifyTrust(returnCert, requestData)) {
throw new Wss4jSecurityValidationException("The certificate used for the signature is not trusted");
}

19
security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorHeaderTestCase.java
View File

@@ -24,6 +24,7 @@ import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapHeaderElement;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.WsSecurityValidationException;
import org.springframework.ws.soap.security.wss4j.callback.SimplePasswordValidationCallbackHandler;
public abstract class Wss4jMessageInterceptorHeaderTestCase extends Wss4jTestCase {
@@ -50,12 +51,10 @@ public abstract class Wss4jMessageInterceptorHeaderTestCase extends Wss4jTestCas
Object result = getMessage(message);
assertNotNull("No result returned", result);
for (Iterator i = message.getEnvelope().getHeader()
.examineAllHeaderElements(); i.hasNext();) {
for (Iterator i = message.getEnvelope().getHeader().examineAllHeaderElements(); i.hasNext();) {
SoapHeaderElement element = (SoapHeaderElement) i.next();
QName name = element.getName();
if (name
.getNamespaceURI()
if (name.getNamespaceURI()
.equals("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")) {
fail("Security Header not removed");
}
@@ -68,4 +67,16 @@ public abstract class Wss4jMessageInterceptorHeaderTestCase extends Wss4jTestCas
assertXpathExists("header2 not found", "/SOAP-ENV:Envelope/SOAP-ENV:Header/header2", getDocument(message));
}
public void testEmptySecurityHeader() throws Exception {
SoapMessage message = loadMessage("emptySecurityHeader-soap.xml");
MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory());
try {
interceptor.validateMessage(message, messageContext);
fail("validation must fail for an empty security header.");
}
catch (WsSecurityValidationException e) {
// expected
}
}
}

10
security/src/test/resources/org/springframework/ws/soap/security/wss4j/emptySecurityHeader-soap.xml Normal file
View File

@@ -0,0 +1,10 @@
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
SOAP-ENV:mustUnderstand="1">
</wsse:Security>
</SOAP-ENV:Header>
<SOAP-ENV:Body>
<tru:StockSymbol xmlns:tru="http://fabrikam123.com/payloads">QQQ</tru:StockSymbol>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>