This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/json-signature in repository https://gitbox.apache.org/repos/asf/cxf.git
commit c7522522fc0fd66e1709bb0e7220e91e1c86e3c8 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Tue Jun 2 14:02:20 2026 +0100 Get the headers from the validated signature entry --- .../jose/jaxrs/AbstractJwsJsonReaderProvider.java | 15 +++++++++++++++ .../security/jose/jaxrs/JwsJsonClientResponseFilter.java | 3 +-- .../jose/jaxrs/JwsJsonContainerRequestFilter.java | 3 +-- 3 files changed, 17 insertions(+), 4 deletions(-) diff --git a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsJsonReaderProvider.java b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsJsonReaderProvider.java index 1457867fd49..e55c163fc86 100644 --- a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsJsonReaderProvider.java +++ b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/AbstractJwsJsonReaderProvider.java @@ -73,6 +73,21 @@ public class AbstractJwsJsonReaderProvider { JAXRSUtils.getCurrentMessage().put(JwsJsonConsumer.class, c); } + protected JwsJsonSignatureEntry getValidatedSignatureEntry(JwsJsonConsumer c) { + @SuppressWarnings("unchecked") + List<JwsJsonSignatureEntry> remaining = + (List<JwsJsonSignatureEntry>)JAXRSUtils.getCurrentMessage().get("jws.json.remaining.entries"); + if (remaining != null) { + for (JwsJsonSignatureEntry sigEntry : c.getSignatureEntries()) { + if (!remaining.contains(sigEntry)) { + return sigEntry; + } + } + } + // If there are no recorded remaining entries then the first (or only) entry is valid. + return c.getSignatureEntries().get(0); + } + public Map<String, Object> getEntryProps() { return entryProps; } diff --git a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonClientResponseFilter.java b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonClientResponseFilter.java index 2a0888bbe9a..794291aa05b 100644 --- a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonClientResponseFilter.java +++ b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonClientResponseFilter.java @@ -55,8 +55,7 @@ public class JwsJsonClientResponseFilter extends AbstractJwsJsonReaderProvider i res.setEntityStream(new ByteArrayInputStream(bytes)); res.getHeaders().putSingle("Content-Length", Integer.toString(bytes.length)); - // the list is guaranteed to be non-empty - JwsJsonSignatureEntry sigEntry = c.getSignatureEntries().get(0); + JwsJsonSignatureEntry sigEntry = getValidatedSignatureEntry(c); String ct = JoseUtils.checkContentType(sigEntry.getUnionHeader().getContentType(), getDefaultMediaType()); if (ct != null) { res.getHeaders().putSingle("Content-Type", ct); diff --git a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonContainerRequestFilter.java b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonContainerRequestFilter.java index d5b7fe8bb47..2dde1824b77 100644 --- a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonContainerRequestFilter.java +++ b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwsJsonContainerRequestFilter.java @@ -62,8 +62,7 @@ public class JwsJsonContainerRequestFilter extends AbstractJwsJsonReaderProvider context.setEntityStream(new ByteArrayInputStream(bytes)); context.getHeaders().putSingle("Content-Length", Integer.toString(bytes.length)); - // the list is guaranteed to be non-empty - JwsJsonSignatureEntry sigEntry = c.getSignatureEntries().get(0); + JwsJsonSignatureEntry sigEntry = getValidatedSignatureEntry(c); String ct = JoseUtils.checkContentType(sigEntry.getUnionHeader().getContentType(), getDefaultMediaType()); if (ct != null) { context.getHeaders().putSingle("Content-Type", ct);
