This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/dom-soap-body in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
commit e186fdb52e1054128b45a46c6c553a07cafb0ab3 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Thu Sep 10 17:10:22 2026 +0100 Make sure we can't register a fake SOAP Body for lookup --- .../java/org/apache/wss4j/dom/callback/DOMCallbackLookup.java | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ws-security-dom/src/main/java/org/apache/wss4j/dom/callback/DOMCallbackLookup.java b/ws-security-dom/src/main/java/org/apache/wss4j/dom/callback/DOMCallbackLookup.java index 7a9cf38d8..47bb67bc3 100644 --- a/ws-security-dom/src/main/java/org/apache/wss4j/dom/callback/DOMCallbackLookup.java +++ b/ws-security-dom/src/main/java/org/apache/wss4j/dom/callback/DOMCallbackLookup.java @@ -96,6 +96,14 @@ public class DOMCallbackLookup implements CallbackLookup { Element foundElement = XMLUtils.findElementById(doc.getDocumentElement(), idToMatch, checkMultipleElements); if (foundElement != null) { + // Reject a Body-named element found elsewhere in the document that is not the + // live SOAP Body, to prevent a signature wrapping attack that relocates a signed + // Body and resolves the reference to the stale copy instead of the real one + if (bodyElement != null && foundElement != bodyElement + && WSConstants.ELEM_BODY.equals(foundElement.getLocalName()) + && bodyElement.getNamespaceURI().equals(foundElement.getNamespaceURI())) { + return null; + } if (context != null) { if (foundElement.hasAttributeNS(WSConstants.WSU_NS, "Id") && idToMatch.equals(foundElement.getAttributeNS(WSConstants.WSU_NS, "Id"))) {
