This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 2_4_x-fixes
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
The following commit(s) were added to refs/heads/2_4_x-fixes by this push:
new 44a33f863 Align StAX security header processing with the DOM code
(#671)
44a33f863 is described below
commit 44a33f86304d9d04200f05b646b5b52fe99a102e
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Fri Sep 4 12:55:40 2026 +0100
Align StAX security header processing with the DOM code (#671)
---
.../input/SecurityHeaderInputProcessor.java | 25 +++++++++++-----------
1 file changed, 12 insertions(+), 13 deletions(-)
diff --git
a/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/SecurityHeaderInputProcessor.java
b/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/SecurityHeaderInputProcessor.java
index c82ed7546..f382a04f9 100644
---
a/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/SecurityHeaderInputProcessor.java
+++
b/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/SecurityHeaderInputProcessor.java
@@ -103,6 +103,10 @@ public class SecurityHeaderInputProcessor extends
AbstractInputProcessor {
((WSSSecurityProperties)
getSecurityProperties()).getActor())) {
continue;
}
+ if (responsibleSecurityHeaderFound) {
+ LOG.debug("Two or more security headers have
the same actor name");
+ throw new
WSSecurityException(WSSecurityException.ErrorCode.INVALID_SECURITY);
+ }
responsibleSecurityHeaderFound = true;
} else if (documentLevel == 4 &&
responsibleSecurityHeaderFound
@@ -132,14 +136,7 @@ public class SecurityHeaderInputProcessor extends
AbstractInputProcessor {
case XMLStreamConstants.END_ELEMENT:
XMLSecEndElement xmlSecEndElement =
xmlSecEvent.asEndElement();
documentLevel = xmlSecEndElement.getDocumentLevel();
- if (documentLevel == 3 && responsibleSecurityHeaderFound
- &&
xmlSecEndElement.getName().equals(WSSConstants.TAG_WSSE_SECURITY)) {
-
- return finalizeHeaderProcessing(
- inputProcessorChain, subInputProcessorChain,
- internalSecurityHeaderBufferProcessor,
xmlSecEventList);
-
- } else if (documentLevel == 4 &&
responsibleSecurityHeaderFound
+ if (documentLevel == 4 && responsibleSecurityHeaderFound
&& WSSUtils.isInSecurityHeader(xmlSecEndElement,
((WSSSecurityProperties)
getSecurityProperties()).getActor())) {
//we are in the security header and the depth is +1,
so every child
@@ -168,11 +165,13 @@ public class SecurityHeaderInputProcessor extends
AbstractInputProcessor {
&&
xmlSecEvent.asStartElement().getName().getNamespaceURI().equals(
WSSUtils.getSOAPMessageVersionNamespace(xmlSecEvent.asStartElement()))
));
- //if we reach this state we didn't find a security header
- //issue a security event to notify about this fact:
- NoSecuritySecurityEvent noSecuritySecurityEvent = new
NoSecuritySecurityEvent();
- noSecuritySecurityEvent.setCorrelationID(IDGenerator.generateID(null));
-
inputProcessorChain.getSecurityContext().registerSecurityEvent(noSecuritySecurityEvent);
+ if (!responsibleSecurityHeaderFound) {
+ //if we reach this state we didn't find a security header
+ //issue a security event to notify about this fact:
+ NoSecuritySecurityEvent noSecuritySecurityEvent = new
NoSecuritySecurityEvent();
+
noSecuritySecurityEvent.setCorrelationID(IDGenerator.generateID(null));
+
inputProcessorChain.getSecurityContext().registerSecurityEvent(noSecuritySecurityEvent);
+ }
return finalizeHeaderProcessing(
inputProcessorChain, subInputProcessorChain,
