This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch 3.2.x-fixes in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 6207b11203790fbe5ac4404b13d2292e30c81462 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Thu Jul 18 16:21:29 2019 +0100 Adding a new configuration tag to control XOP Include for WS-SecurityPolicy --- .../org/apache/cxf/ws/security/SecurityConstants.java | 17 ++++++++++++----- .../wss4j/policyhandlers/AbstractBindingBuilder.java | 3 ++- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java index 1784e6e..b9146fc 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java @@ -145,15 +145,22 @@ public final class SecurityConstants extends org.apache.cxf.rt.security.Security * Signatures using WSConstants.C14N_EXCL_OMIT_COMMENTS. Default is "true". */ public static final String ADD_INCLUSIVE_PREFIXES = "ws-security.add.inclusive.prefixes"; - + /** - * Whether to disable the enforcement of the WS-SecurityPolicy 'RequireClientCertificate' policy. - * Default is "false". Some servers may not do client certificate verification at the start of the SSL - * handshake, and therefore the client certs may not be available to the WS-Security layer for policy + * Whether to disable the enforcement of the WS-SecurityPolicy 'RequireClientCertificate' policy. + * Default is "false". Some servers may not do client certificate verification at the start of the SSL + * handshake, and therefore the client certs may not be available to the WS-Security layer for policy * verification at that time. */ public static final String DISABLE_REQ_CLIENT_CERT_CHECK = "ws-security.disable.require.client.cert.check"; + /** + * Whether to search for and expand xop:Include Elements for encryption and signature (on the outbound + * side) or for signature verification (on the inbound side). This ensures that the actual bytes are signed, + * and not just the reference. The default is "true" if MTOM is enabled, false otherwise. + */ + public static final String EXPAND_XOP_INCLUDE = "ws-security.expand.xop.include"; + // // Non-boolean WS-Security Configuration parameters // @@ -425,7 +432,7 @@ public final class SecurityConstants extends org.apache.cxf.rt.security.Security KERBEROS_IS_USERNAME_IN_SERVICENAME_FORM, KERBEROS_REQUEST_CREDENTIAL_DELEGATION, POLICY_VALIDATOR_MAP, STORE_BYTES_IN_ATTACHMENT, USE_ATTACHMENT_ENCRYPTION_CONTENT_ONLY_TRANSFORM, SYMMETRIC_SIGNATURE_ALGORITHM, SECURITY_CONTEXT_CREATOR, SECURITY_TOKEN_LIFETIME, - DISABLE_REQ_CLIENT_CERT_CHECK + DISABLE_REQ_CLIENT_CERT_CHECK, EXPAND_XOP_INCLUDE })); for (String commonProperty : COMMON_PROPERTIES) { s.add(commonProperty); diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractBindingBuilder.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractBindingBuilder.java index 8d93ddd..d633f10 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractBindingBuilder.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractBindingBuilder.java @@ -223,7 +223,8 @@ public abstract class AbstractBindingBuilder extends AbstractCommonBindingHandle storeBytesInAttachment = false; } } - expandXopInclude = mtomEnabled; + expandXopInclude = MessageUtils.getContextualBoolean( + message, SecurityConstants.EXPAND_XOP_INCLUDE, mtomEnabled); wsDocInfo = new WSDocInfo(secHeader.getSecurityHeaderElement().getOwnerDocument());
