Hello,
I'm fighting with cxf 3.0.9 for more than a week and finally found problem in 
xmlsec library.
Starting from version 2.0.0 the 
Canonicalizer20010315_ExclOmitCommentsTransformer transformer works incorrectly.
When the list of inclusive namespaces is added the transformer adds empty 
namespaces declarations at the root element if the namespace is not defined 
already at this element.

So, here's example:
inclusiveNamespaces = "SOAP-ENV ec ec1 ns0 ns1 ns11 ns2 ns4 ns9"

output root:
<SOAP-ENV:Body xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"; 
xmlns:ec="" xmlns:ec1="" xmlns:ns0="" xmlns:ns1="" xmlns:ns11="" xmlns:ns2="" 
xmlns:ns4="" xmlns:ns9="" 
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd";
 wsu:Id="XWSSGID-1465203363337-2063525437">


As you can see the empty declarations have been added causing the calculated 
digest doesn't match, so the message is not passing the signature verification.

Attached are: sample code and the transformation result. Example was tested 
with xmlspec 2.0.0 and xmlspec 2.0.6.
Old versions 1.5.7, 1.5.8 are working fine - please take a look at: 
Canonicalizer20010315Excl.java, starting from line 201 -> it's not adding all 
prefixes defined in "inclusiveNamespaces" but only those for which there's a 
need.

Please help!

Best regards,
Szymon


Attachment: NamespaceBug.java
Description: NamespaceBug.java

<SOAP-ENV:Body xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"; xmlns:ec="" xmlns:ec1="" xmlns:ns0="" xmlns:ns1="" xmlns:ns11="" xmlns:ns2="" xmlns:ns4="" xmlns:ns9="" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"; wsu:Id="XWSSGID-1465203363337-2063525437">
	<ec:SubmitRetrieveInterchangeAgreementsRequestResponse xmlns:ec="ec:services:wsdl:RetrieveInterchangeAgreementsRequest-2" xmlns:ec1="ec:schema:xsd:CommonBasicComponents-0.1">
		<ns0:RetrieveInterchangeAgreementsResponse xmlns:ns0="ec:services:wsdl:RetrieveInterchangeAgreementsRequest-2" xmlns:ns1="urn:oasis:names:specification:ubl:schema:xsd:CommonExtensionComponents-2" xmlns:ns11="urn:oasis:names:specification:ubl:schema:xsd:CommonAggregateComponents-2" xmlns:ns2="urn:oasis:names:specification:ubl:schema:xsd:CommonBasicComponents-2" xmlns:ns4="ec:schema:xsd:CommonBasicComponents-1" xmlns:ns9="ec:schema:xsd:CommonAggregateComponents-2">
			<ns9:InterchangeAgreement>
				<ns11:SenderParty>
					<ns2:EndpointID schemeID="GLN">DEV1_NOTENC_WEB_PARTY</ns2:EndpointID>
					<ns11:PartyIdentification>
						<ns2:ID schemeID="GLN">DEV1_NOTENC_WEB_PARTY</ns2:ID>
					</ns11:PartyIdentification>
				</ns11:SenderParty>
				<ns11:ReceiverParty>
					<ns2:EndpointID schemeID="GLN">DEV1_NOTENC_APP_PARTY</ns2:EndpointID>
					<ns11:PartyIdentification>
						<ns2:ID schemeID="GLN">DEV1_NOTENC_APP_PARTY</ns2:ID>
					</ns11:PartyIdentification>
				</ns11:ReceiverParty>
				<ns9:SecurityInformation>
					<ns4:ConfidentialityLevelCode>0</ns4:ConfidentialityLevelCode>
					<ns4:IntegrityLevelCode>0</ns4:IntegrityLevelCode>
					<ns4:AvailabilityLevelCode>0</ns4:AvailabilityLevelCode>
				</ns9:SecurityInformation>
				<ns2:DocumentTypeCode></ns2:DocumentTypeCode>
				<ns2:ProfileID>Bundle</ns2:ProfileID>
			</ns9:InterchangeAgreement>
		</ns0:RetrieveInterchangeAgreementsResponse>
	</ec:SubmitRetrieveInterchangeAgreementsRequestResponse>
</SOAP-ENV:Body>

Reply via email to