This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
The following commit(s) were added to refs/heads/master by this push:
new 340ff3fce Enforce signature protection as well for SOAP 12 streaming
(#666)
340ff3fce is described below
commit 340ff3fcec51329e51458a6c323dcd3fbee1cfbe
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Thu Sep 3 09:26:16 2026 +0100
Enforce signature protection as well for SOAP 12 streaming (#666)
---
.../SignatureProtectionAssertionState.java | 35 +++++++++++++++-------
.../wss4j/policy/stax/enforcer/PolicyEnforcer.java | 2 +-
2 files changed, 25 insertions(+), 12 deletions(-)
diff --git
a/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/SignatureProtectionAssertionState.java
b/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/SignatureProtectionAssertionState.java
index 3873001fb..4747aae0c 100644
---
a/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/SignatureProtectionAssertionState.java
+++
b/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/SignatureProtectionAssertionState.java
@@ -54,21 +54,34 @@ public class SignatureProtectionAssertionState extends
AssertionState implements
private final List<List<QName>> elementPaths = new ArrayList<>();
private PolicyAsserter policyAsserter;
+ /**
+ * @deprecated use the constructor taking a soap12 argument instead - this
constructor
+ * only matches SOAP 1.1 element paths, so sp:EncryptSignature
is never
+ * enforced for SOAP 1.2 messages
+ */
+ @Deprecated
public SignatureProtectionAssertionState(AbstractSecurityAssertion
assertion,
PolicyAsserter policyAsserter,
boolean asserted) {
+ this(assertion, policyAsserter, asserted, false);
+ }
+
+ public SignatureProtectionAssertionState(AbstractSecurityAssertion
assertion,
+ PolicyAsserter policyAsserter,
+ boolean asserted,
+ boolean soap12) {
super(assertion, asserted);
- List<QName> signature11Path = new LinkedList<>();
- signature11Path.addAll(WSSConstants.SOAP_11_HEADER_PATH);
- signature11Path.add(WSSConstants.TAG_WSSE_SECURITY);
- signature11Path.add(WSSConstants.TAG_dsig_Signature);
- elementPaths.add(signature11Path);
-
- List<QName> signatureConfirmation11Path = new LinkedList<>();
- signatureConfirmation11Path.addAll(WSSConstants.SOAP_11_HEADER_PATH);
- signatureConfirmation11Path.add(WSSConstants.TAG_WSSE_SECURITY);
- signatureConfirmation11Path.add(WSSConstants.TAG_WSSE11_SIG_CONF);
- elementPaths.add(signatureConfirmation11Path);
+ List<QName> signaturePath = new LinkedList<>();
+ signaturePath.addAll(soap12 ? WSSConstants.SOAP_12_HEADER_PATH :
WSSConstants.SOAP_11_HEADER_PATH);
+ signaturePath.add(WSSConstants.TAG_WSSE_SECURITY);
+ signaturePath.add(WSSConstants.TAG_dsig_Signature);
+ elementPaths.add(signaturePath);
+
+ List<QName> signatureConfirmationPath = new LinkedList<>();
+ signatureConfirmationPath.addAll(soap12 ?
WSSConstants.SOAP_12_HEADER_PATH : WSSConstants.SOAP_11_HEADER_PATH);
+ signatureConfirmationPath.add(WSSConstants.TAG_WSSE_SECURITY);
+ signatureConfirmationPath.add(WSSConstants.TAG_WSSE11_SIG_CONF);
+ elementPaths.add(signatureConfirmationPath);
this.policyAsserter = policyAsserter;
if (this.policyAsserter == null) {
diff --git
a/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/enforcer/PolicyEnforcer.java
b/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/enforcer/PolicyEnforcer.java
index ea266fc7e..7782cfcdd 100644
---
a/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/enforcer/PolicyEnforcer.java
+++
b/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/enforcer/PolicyEnforcer.java
@@ -376,7 +376,7 @@ public class PolicyEnforcer implements
SecurityEventListener {
AbstractSymmetricAsymmetricBinding
abstractSymmetricAsymmetricBinding =
(AbstractSymmetricAsymmetricBinding)
abstractSecurityAssertion;
assertableList.add(new
ProtectionOrderAssertionState(abstractSymmetricAsymmetricBinding,
policyAsserter, true));
- assertableList.add(new
SignatureProtectionAssertionState(abstractSymmetricAsymmetricBinding,
policyAsserter, true));
+ assertableList.add(new
SignatureProtectionAssertionState(abstractSymmetricAsymmetricBinding,
policyAsserter, true, soap12));
if
(abstractSymmetricAsymmetricBinding.isOnlySignEntireHeadersAndBody()) {
//initialized with asserted=true because we do negative
matching
assertableList.add(new
OnlySignEntireHeadersAndBodyAssertionState(abstractSecurityAssertion,
policyAsserter,
