This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/soap12-sigprotection in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
commit bb1fb5933359759a7416d8f547ceabe683f513b1 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Wed Sep 2 15:40:39 2026 +0100 Enforce signature protection as well for SOAP 12 streaming --- .../SignatureProtectionAssertionState.java | 35 +++++++++++++++------- .../wss4j/policy/stax/enforcer/PolicyEnforcer.java | 2 +- 2 files changed, 25 insertions(+), 12 deletions(-) diff --git a/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/SignatureProtectionAssertionState.java b/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/SignatureProtectionAssertionState.java index 3873001fb..4747aae0c 100644 --- a/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/SignatureProtectionAssertionState.java +++ b/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/SignatureProtectionAssertionState.java @@ -54,21 +54,34 @@ public class SignatureProtectionAssertionState extends AssertionState implements private final List<List<QName>> elementPaths = new ArrayList<>(); private PolicyAsserter policyAsserter; + /** + * @deprecated use the constructor taking a soap12 argument instead - this constructor + * only matches SOAP 1.1 element paths, so sp:EncryptSignature is never + * enforced for SOAP 1.2 messages + */ + @Deprecated public SignatureProtectionAssertionState(AbstractSecurityAssertion assertion, PolicyAsserter policyAsserter, boolean asserted) { + this(assertion, policyAsserter, asserted, false); + } + + public SignatureProtectionAssertionState(AbstractSecurityAssertion assertion, + PolicyAsserter policyAsserter, + boolean asserted, + boolean soap12) { super(assertion, asserted); - List<QName> signature11Path = new LinkedList<>(); - signature11Path.addAll(WSSConstants.SOAP_11_HEADER_PATH); - signature11Path.add(WSSConstants.TAG_WSSE_SECURITY); - signature11Path.add(WSSConstants.TAG_dsig_Signature); - elementPaths.add(signature11Path); - - List<QName> signatureConfirmation11Path = new LinkedList<>(); - signatureConfirmation11Path.addAll(WSSConstants.SOAP_11_HEADER_PATH); - signatureConfirmation11Path.add(WSSConstants.TAG_WSSE_SECURITY); - signatureConfirmation11Path.add(WSSConstants.TAG_WSSE11_SIG_CONF); - elementPaths.add(signatureConfirmation11Path); + List<QName> signaturePath = new LinkedList<>(); + signaturePath.addAll(soap12 ? WSSConstants.SOAP_12_HEADER_PATH : WSSConstants.SOAP_11_HEADER_PATH); + signaturePath.add(WSSConstants.TAG_WSSE_SECURITY); + signaturePath.add(WSSConstants.TAG_dsig_Signature); + elementPaths.add(signaturePath); + + List<QName> signatureConfirmationPath = new LinkedList<>(); + signatureConfirmationPath.addAll(soap12 ? WSSConstants.SOAP_12_HEADER_PATH : WSSConstants.SOAP_11_HEADER_PATH); + signatureConfirmationPath.add(WSSConstants.TAG_WSSE_SECURITY); + signatureConfirmationPath.add(WSSConstants.TAG_WSSE11_SIG_CONF); + elementPaths.add(signatureConfirmationPath); this.policyAsserter = policyAsserter; if (this.policyAsserter == null) { diff --git a/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/enforcer/PolicyEnforcer.java b/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/enforcer/PolicyEnforcer.java index ea266fc7e..7782cfcdd 100644 --- a/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/enforcer/PolicyEnforcer.java +++ b/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/enforcer/PolicyEnforcer.java @@ -376,7 +376,7 @@ public class PolicyEnforcer implements SecurityEventListener { AbstractSymmetricAsymmetricBinding abstractSymmetricAsymmetricBinding = (AbstractSymmetricAsymmetricBinding) abstractSecurityAssertion; assertableList.add(new ProtectionOrderAssertionState(abstractSymmetricAsymmetricBinding, policyAsserter, true)); - assertableList.add(new SignatureProtectionAssertionState(abstractSymmetricAsymmetricBinding, policyAsserter, true)); + assertableList.add(new SignatureProtectionAssertionState(abstractSymmetricAsymmetricBinding, policyAsserter, true, soap12)); if (abstractSymmetricAsymmetricBinding.isOnlySignEntireHeadersAndBody()) { //initialized with asserted=true because we do negative matching assertableList.add(new OnlySignEntireHeadersAndBodyAssertionState(abstractSecurityAssertion, policyAsserter,
