This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/main by this push:
new 92e33eee311 Use properly random IDs for WS-N (#3412)
92e33eee311 is described below
commit 92e33eee3110384cfa7dd871e4b4a9e19d47e4af
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Mon Aug 31 13:37:06 2026 +0100
Use properly random IDs for WS-N (#3412)
---
.../java/org/apache/cxf/wsn/util/IdGenerator.java | 13 +++--
.../org/apache/cxf/wsn/util/IdGeneratorTest.java | 55 ++++++++++++++++++++++
2 files changed, 63 insertions(+), 5 deletions(-)
diff --git
a/services/wsn/wsn-api/src/main/java/org/apache/cxf/wsn/util/IdGenerator.java
b/services/wsn/wsn-api/src/main/java/org/apache/cxf/wsn/util/IdGenerator.java
index 5d47a92bbd8..358715d7be2 100644
---
a/services/wsn/wsn-api/src/main/java/org/apache/cxf/wsn/util/IdGenerator.java
+++
b/services/wsn/wsn-api/src/main/java/org/apache/cxf/wsn/util/IdGenerator.java
@@ -21,6 +21,7 @@ package org.apache.cxf.wsn.util;
import java.net.InetAddress;
import java.net.ServerSocket;
+import java.util.UUID;
import java.util.logging.Level;
import java.util.logging.Logger;
@@ -42,8 +43,6 @@ public class IdGenerator {
private String seed;
- private long sequence;
-
public IdGenerator() {
this("ID:");
}
@@ -101,13 +100,17 @@ public class IdGenerator {
}
/**
- * Generate a unqiue id
+ * Generate a unique id. The variable part of the id is generated from a
+ * cryptographically strong random source rather than a sequential counter:
+ * the ids are used as unguessable endpoint addresses for resources such as
+ * subscriptions, and a client knowing one id must not be able to derive
+ * the ids handed out to other clients.
*
* @return a unique id
*/
- public synchronized String generateId() {
- return this.seed + (this.sequence++);
+ public String generateId() {
+ return this.seed + UUID.randomUUID();
}
/**
diff --git
a/services/wsn/wsn-core/src/test/java/org/apache/cxf/wsn/util/IdGeneratorTest.java
b/services/wsn/wsn-core/src/test/java/org/apache/cxf/wsn/util/IdGeneratorTest.java
new file mode 100644
index 00000000000..48a7a740d17
--- /dev/null
+++
b/services/wsn/wsn-core/src/test/java/org/apache/cxf/wsn/util/IdGeneratorTest.java
@@ -0,0 +1,55 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.wsn.util;
+
+import java.util.HashSet;
+import java.util.Set;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+public class IdGeneratorTest {
+
+ @Test
+ public void testIdsAreNotSequential() {
+ IdGenerator generator = new IdGenerator();
+ String first = generator.generateId();
+ String second = generator.generateId();
+
+ // The variable part must not be a small sequential counter: a client
seeing
+ // its own id must not be able to derive the ids handed out to other
clients
+ String firstSuffix = first.substring(first.lastIndexOf(':') + 1);
+ String secondSuffix = second.substring(second.lastIndexOf(':') + 1);
+ assertFalse("id suffix must not be a bare counter",
firstSuffix.matches("[0-9]+"));
+ assertFalse("id suffix must not be a bare counter",
secondSuffix.matches("[0-9]+"));
+ assertTrue("id suffix must carry at least 122 bits of randomness",
+ firstSuffix.length() >= 32);
+ }
+
+ @Test
+ public void testIdsAreUnique() {
+ IdGenerator generator = new IdGenerator();
+ Set<String> ids = new HashSet<>();
+ for (int i = 0; i < 1000; i++) {
+ assertTrue("duplicate id generated",
ids.add(generator.generateSanitizedId()));
+ }
+ }
+}
\ No newline at end of file
