Repository: cxf Updated Branches: refs/heads/2.7.x-fixes ddde19496 -> 55b805b3a
[CXF-6222] - Password can end up in log file Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/55b805b3 Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/55b805b3 Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/55b805b3 Branch: refs/heads/2.7.x-fixes Commit: 55b805b3a7ed9dca925a82d436d2f16987207cf3 Parents: ddde194 Author: Colm O hEigeartaigh <[email protected]> Authored: Tue Jan 27 14:56:42 2015 +0000 Committer: Colm O hEigeartaigh <[email protected]> Committed: Tue Jan 27 15:06:22 2015 +0000 ---------------------------------------------------------------------- .../trust/AuthPolicyValidatingInterceptor.java | 4 +-- .../cxf/ws/security/trust/Messages.properties | 2 +- .../AuthPolicyValidatingInterceptorTest.java | 36 ++++++++++++++++++++ 3 files changed, 38 insertions(+), 4 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf/blob/55b805b3/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AuthPolicyValidatingInterceptor.java ---------------------------------------------------------------------- diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AuthPolicyValidatingInterceptor.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AuthPolicyValidatingInterceptor.java index 1cb9e3c..5d979b7 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AuthPolicyValidatingInterceptor.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AuthPolicyValidatingInterceptor.java @@ -57,15 +57,13 @@ public class AuthPolicyValidatingInterceptor extends AbstractPhaseInterceptor<Me AuthorizationPolicy policy = message.get(AuthorizationPolicy.class); if (policy == null || policy.getUserName() == null || policy.getPassword() == null) { String name = null; - String password = null; if (policy != null) { name = policy.getUserName(); - password = policy.getPassword(); } org.apache.cxf.common.i18n.Message errorMsg = new org.apache.cxf.common.i18n.Message("NO_USER_PASSWORD", BUNDLE, - name, password); + name); LOG.warning(errorMsg.toString()); throw new SecurityException(errorMsg.toString()); } http://git-wip-us.apache.org/repos/asf/cxf/blob/55b805b3/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/Messages.properties ---------------------------------------------------------------------- diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/Messages.properties b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/Messages.properties index 570dacd..3bf9456 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/Messages.properties +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/Messages.properties @@ -24,7 +24,7 @@ NO_ENTROPY=Could not find Entropy in RequestSecurityTokenResponse DERIVED_KEY_ERROR=Exception while trying to create secret key from RequestSecurityTokenResponse ENCRYPTED_KEY_ERROR=Exception while trying to decrypt key from RequestSecurityTokenResponse VALIDATION_FAILED=Validation of security token failed: {0} -NO_USER_PASSWORD=No user name and/or password is available, name: {0}, password: {1} +NO_USER_PASSWORD=No user name and/or password is available, name: {0} ADDRESS_NOT_MATCHED=Cannot match the address {0} to the WSDL received via WS-MEX WS_MEX_ERROR=Exception when trying to retrieve/process a WSDL via WS-MEX NO_LOCATION=The STSClient is not configured with either a location or wsdlLocation property http://git-wip-us.apache.org/repos/asf/cxf/blob/55b805b3/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AuthPolicyValidatingInterceptorTest.java ---------------------------------------------------------------------- diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AuthPolicyValidatingInterceptorTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AuthPolicyValidatingInterceptorTest.java index eab8e16..9e26d8b 100644 --- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AuthPolicyValidatingInterceptorTest.java +++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AuthPolicyValidatingInterceptorTest.java @@ -47,6 +47,42 @@ public class AuthPolicyValidatingInterceptorTest extends Assert { assertTrue(validator.isValidated()); } + @Test + public void testInvalidUsernamePassword() throws Exception { + AuthPolicyValidatingInterceptor in = new AuthPolicyValidatingInterceptor(); + TestSTSTokenValidator validator = new TestSTSTokenValidator(); + in.setValidator(validator); + + AuthorizationPolicy policy = new AuthorizationPolicy(); + policy.setUserName("bob"); + policy.setPassword("pswd2"); + Message message = new MessageImpl(); + message.put(AuthorizationPolicy.class, policy); + + in.handleMessage(message); + + assertFalse(validator.isValidated()); + } + + @Test + public void testNoUsername() throws Exception { + AuthPolicyValidatingInterceptor in = new AuthPolicyValidatingInterceptor(); + TestSTSTokenValidator validator = new TestSTSTokenValidator(); + in.setValidator(validator); + + AuthorizationPolicy policy = new AuthorizationPolicy(); + policy.setPassword("pswd"); + Message message = new MessageImpl(); + message.put(AuthorizationPolicy.class, policy); + + try { + in.handleMessage(message); + fail("Failure expected with no username"); + } catch (SecurityException ex) { + // expected + } + } + private static class TestSTSTokenValidator extends STSTokenValidator { private boolean validated;
