rootvector2 commented on PR #3632: URL: https://github.com/apache/cxf/pull/3632#issuecomment-6460582530
Good catch. The GET/HEAD and non-2xx/204 exemption in `MessageVerifier.verifyMessage` now only drops `digest` when the body is empty, so an unsigned body on those paths is rejected too. Added `filterUnsignedBodyOnGetTest` and `clientFilterUnsignedErrorResponseBodyTest` (204 and 404) for that. The read failure now says "failed to read the message body" and I shortened the comment as suggested. One side effect: `MessageVerifierTest.defaultRequiredHeaderPresent` and `defaultRequiredHeaderPresentTestNotRequired` verified an unsigned `Hello` body on a GET, which is now rejected. Those tests are about the default required headers, so I pass a null body there instead. Module tests and `JAXRSHTTPSignatureTest` pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
