svn commit: r1546009 - in /webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security: processor/SAMLTokenProcessor.java saml/ext/AssertionWrapper.java

[coheigea]

Author: coheigea
Date: Wed Nov 27 12:08:36 2013
New Revision: 1546009

URL: http://svn.apache.org/r1546009
Log:
Avoid NPE if a signed Assertion does not have a KeyInfo Element

Modified:
    
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/processor/SAMLTokenProcessor.java
    
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/AssertionWrapper.java

Modified: 
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/processor/SAMLTokenProcessor.java
URL: 
http://svn.apache.org/viewvc/webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/processor/SAMLTokenProcessor.java?rev=1546009&r1=1546008&r2=1546009&view=diff
==============================================================================
--- 
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/processor/SAMLTokenProcessor.java
 (original)
+++ 
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/processor/SAMLTokenProcessor.java
 Wed Nov 27 12:08:36 2013
@@ -136,6 +136,12 @@ public class SAMLTokenProcessor implemen
             
             Signature sig = assertion.getSignature();
             KeyInfo keyInfo = sig.getKeyInfo();
+            if (keyInfo == null) {
+                throw new WSSecurityException(
+                    WSSecurityException.ErrorCode.FAILURE, 
"invalidSAMLsecurity",
+                    "cannot get certificate or key"
+                );
+            }
             SAMLKeyInfo samlKeyInfo = 
                 SAMLUtil.getCredentialDirectlyFromKeyInfo(
                     keyInfo.getDOM(), data

Modified: 
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/AssertionWrapper.java
URL: 
http://svn.apache.org/viewvc/webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/AssertionWrapper.java?rev=1546009&r1=1546008&r2=1546009&view=diff
==============================================================================
--- 
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/AssertionWrapper.java
 (original)
+++ 
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/AssertionWrapper.java
 Wed Nov 27 12:08:36 2013
@@ -533,6 +533,12 @@ public class AssertionWrapper {
         Signature sig = getSignature();
         if (sig != null) {
             KeyInfo keyInfo = sig.getKeyInfo();
+            if (keyInfo == null) {
+                throw new WSSecurityException(
+                    WSSecurityException.ErrorCode.FAILURE, 
"invalidSAMLsecurity",
+                    "cannot get certificate or key"
+                );
+            }
             SAMLKeyInfo samlKeyInfo = 
                 SAMLUtil.getCredentialDirectlyFromKeyInfo(keyInfo.getDOM(), 
data);
             verifySignature(samlKeyInfo);