dxbjavid opened a new pull request, #3619: URL: https://github.com/apache/cxf/pull/3619
SimpleAuthorizingInterceptor.createMethodSig never writes the comma between parameter types, because first is only reset inside the branch that is never entered, so a methodRolesMap entry keyed by a full signature such as "void transfer(java.lang.String, long)" never matches. getExpectedRoles then falls back to the method name and globalRoles, and when neither is set the operation appears to need no roles at all, which seems to let any caller (anonymous ones included, by default) through to an overload the integrator meant to restrict. Moving the reset out of the branch gives the intended signature format, SecureAnnotationsInterceptor is unaffected since it builds and looks up its keys through the same method, and a regression test is added. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
