From f2d7d60850e4e946a9b3029d3a096f0a27d66a66 Mon Sep 17 00:00:00 2001 From: Arjen Poutsma Date: Tue, 18 Nov 2008 10:02:27 +0000 Subject: [PATCH] SWS-448 --- .../wss4j/Wss4jSecurityInterceptor.java | 15 ++++++++------- ...Wss4jMessageInterceptorHeaderTestCase.java | 19 +++++++++++++++---- .../wss4j/emptySecurityHeader-soap.xml | 10 ++++++++++ 3 files changed, 33 insertions(+), 11 deletions(-) create mode 100644 security/src/test/resources/org/springframework/ws/soap/security/wss4j/emptySecurityHeader-soap.xml diff --git a/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java b/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java index faf05b52..c26dd94a 100755 --- a/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java +++ b/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java @@ -45,6 +45,7 @@ import org.w3c.dom.Document; import org.springframework.beans.factory.InitializingBean; import org.springframework.util.Assert; +import org.springframework.util.CollectionUtils; import org.springframework.util.StringUtils; import org.springframework.ws.context.DefaultMessageContext; import org.springframework.ws.context.MessageContext; @@ -495,11 +496,12 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl WSSecurityEngine securityEngine = WSSecurityEngine.getInstance(); try { - Vector results = securityEngine.processSecurityHeader(envelopeAsDocument, validationActor, - validationCallbackHandler, validationSignatureCrypto, validationDecryptionCrypto); + Vector results = securityEngine + .processSecurityHeader(envelopeAsDocument, validationActor, validationCallbackHandler, + validationSignatureCrypto, validationDecryptionCrypto); // Results verification - if (results == null) { + if (CollectionUtils.isEmpty(results)) { throw new Wss4jSecurityValidationException("No WS-Security header found"); } @@ -532,8 +534,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl */ private void updateContextWithResults(MessageContext messageContext, Vector results) { Vector handlerResults; - if ((handlerResults = (Vector) messageContext - .getProperty(WSHandlerConstants.RECV_RESULTS)) == null) { + if ((handlerResults = (Vector) messageContext.getProperty(WSHandlerConstants.RECV_RESULTS)) == null) { handlerResults = new Vector(); messageContext.setProperty(WSHandlerConstants.RECV_RESULTS, handlerResults); } @@ -549,8 +550,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl WSSecurityEngineResult actionResult = WSSecurityUtil.fetchActionResult(results, WSConstants.SIGN); if (actionResult != null) { - X509Certificate returnCert = - (X509Certificate) actionResult.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE); + X509Certificate returnCert = (X509Certificate) actionResult.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE) + ; if (!handler.verifyTrust(returnCert, requestData)) { throw new Wss4jSecurityValidationException("The certificate used for the signature is not trusted"); } diff --git a/security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorHeaderTestCase.java b/security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorHeaderTestCase.java index 7411bf7e..19fe2df9 100755 --- a/security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorHeaderTestCase.java +++ b/security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorHeaderTestCase.java @@ -24,6 +24,7 @@ import org.springframework.ws.context.DefaultMessageContext; import org.springframework.ws.context.MessageContext; import org.springframework.ws.soap.SoapHeaderElement; import org.springframework.ws.soap.SoapMessage; +import org.springframework.ws.soap.security.WsSecurityValidationException; import org.springframework.ws.soap.security.wss4j.callback.SimplePasswordValidationCallbackHandler; public abstract class Wss4jMessageInterceptorHeaderTestCase extends Wss4jTestCase { @@ -50,12 +51,10 @@ public abstract class Wss4jMessageInterceptorHeaderTestCase extends Wss4jTestCas Object result = getMessage(message); assertNotNull("No result returned", result); - for (Iterator i = message.getEnvelope().getHeader() - .examineAllHeaderElements(); i.hasNext();) { + for (Iterator i = message.getEnvelope().getHeader().examineAllHeaderElements(); i.hasNext();) { SoapHeaderElement element = (SoapHeaderElement) i.next(); QName name = element.getName(); - if (name - .getNamespaceURI() + if (name.getNamespaceURI() .equals("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")) { fail("Security Header not removed"); } @@ -68,4 +67,16 @@ public abstract class Wss4jMessageInterceptorHeaderTestCase extends Wss4jTestCas assertXpathExists("header2 not found", "/SOAP-ENV:Envelope/SOAP-ENV:Header/header2", getDocument(message)); } + + public void testEmptySecurityHeader() throws Exception { + SoapMessage message = loadMessage("emptySecurityHeader-soap.xml"); + MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory()); + try { + interceptor.validateMessage(message, messageContext); + fail("validation must fail for an empty security header."); + } + catch (WsSecurityValidationException e) { + // expected + } + } } diff --git a/security/src/test/resources/org/springframework/ws/soap/security/wss4j/emptySecurityHeader-soap.xml b/security/src/test/resources/org/springframework/ws/soap/security/wss4j/emptySecurityHeader-soap.xml new file mode 100644 index 00000000..08aa1c65 --- /dev/null +++ b/security/src/test/resources/org/springframework/ws/soap/security/wss4j/emptySecurityHeader-soap.xml @@ -0,0 +1,10 @@ + + + + + + + QQQ + +