[
https://issues.apache.org/jira/browse/CXF-6409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14561445#comment-14561445
]
Dallas Vaughan commented on CXF-6409:
-------------------------------------
Hi Colm,
I checked out the 3.0.x-fixes branch and installed locally, and, while it looks
like it's using the new BinarySecurity class, it is failing in the setToken
method. It's throwing a NullPointerException on {{node.setData(...)}} (line
214) because of the following (in comments):
{code:title=BinarySecurity.class}
public void setToken(byte[] data) {
if(data == null) {
throw new IllegalArgumentException("data == null");
} else {
Text node = this.getFirstNode(); //returns null
node.setData(Base64.encode(data)); //throws NPE
}
}
protected Text getFirstNode() {
Node node = this.element.getFirstChild(); //node = <xop:Include>
return node != null && 3 == node.getNodeType()?(Text)node:null;
//node.getNodeType() = 1, so this returns null
}
{code}
> CXF web service cannot process MTOM/XOP-optimized content within a
> CipherValue element
> --------------------------------------------------------------------------------------
>
> Key: CXF-6409
> URL: https://issues.apache.org/jira/browse/CXF-6409
> Project: CXF
> Issue Type: Bug
> Components: WS-* Components
> Affects Versions: 3.0.4
> Reporter: Dallas Vaughan
> Assignee: Colm O hEigeartaigh
>
> When a CXF (WS-Security streaming-enabled) web service endpoint is configured
> to use WS-Security and MTOM, CXF cannot handle requests from .NET and Metro
> clients because it cannot process {{xop:Include}} elements that are children
> of {{enc:CipherValue}} elements, as both of these clients will optimize any
> large encrypted (base64-encoded binary) content by serializing it as a MIME
> part.
> For example, when a Metro MTOM-optimized WS-Security-based request is sent to
> a CXF endpoint, the following exception is thrown within
> {{org.apache.xml.security.stax.impl.processor.input.AbstractDecryptInputProcessor$DecryptionThread.run()}}:
> {code}org.apache.xml.security.exceptions.XMLSecurityException: Unexpected
> StAX-Event: START_ELEMENT{code}
> This makes it impossible for .NET and Metro clients to communicate with CXF
> endpoints which have the MTOM and encryption policies specified.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
