rootvector2 opened a new pull request, #3625: URL: https://github.com/apache/cxf/pull/3625
`SAMLSSOResponseValidator.validateSubjectConfirmation` replay-checks a POST binding assertion with a non-atomic `contains` then `putId` on the `TokenReplayCache`, so concurrent submissions of one captured response all pass the lookup before any of them is cached and are all accepted (reproducer: 8 concurrent submissions of the same assertion id, accepted 8 times against both `EHCacheTokenReplayCache` and `JCacheTokenReplayCache`), found while reviewing the JAX-RS SAML SSO side of #3622, and fixed by adding `TokenReplayCache.putIdIfAbsent` backed by the atomic `putIfAbsent` of Ehcache and JCache (synchronized default for custom caches) and using it in the validator, with regression tests for both caches and the validator. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
