This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/wsn-ids in repository https://gitbox.apache.org/repos/asf/cxf.git
commit c15d1a15bff340ff7cef44798466aae0da1d8bb1 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Fri Aug 28 17:06:29 2026 +0100 Use properly random IDs for WS-N --- .../java/org/apache/cxf/wsn/util/IdGenerator.java | 13 +++-- .../org/apache/cxf/wsn/util/IdGeneratorTest.java | 55 ++++++++++++++++++++++ 2 files changed, 63 insertions(+), 5 deletions(-) diff --git a/services/wsn/wsn-api/src/main/java/org/apache/cxf/wsn/util/IdGenerator.java b/services/wsn/wsn-api/src/main/java/org/apache/cxf/wsn/util/IdGenerator.java index 5d47a92bbd8..358715d7be2 100644 --- a/services/wsn/wsn-api/src/main/java/org/apache/cxf/wsn/util/IdGenerator.java +++ b/services/wsn/wsn-api/src/main/java/org/apache/cxf/wsn/util/IdGenerator.java @@ -21,6 +21,7 @@ package org.apache.cxf.wsn.util; import java.net.InetAddress; import java.net.ServerSocket; +import java.util.UUID; import java.util.logging.Level; import java.util.logging.Logger; @@ -42,8 +43,6 @@ public class IdGenerator { private String seed; - private long sequence; - public IdGenerator() { this("ID:"); } @@ -101,13 +100,17 @@ public class IdGenerator { } /** - * Generate a unqiue id + * Generate a unique id. The variable part of the id is generated from a + * cryptographically strong random source rather than a sequential counter: + * the ids are used as unguessable endpoint addresses for resources such as + * subscriptions, and a client knowing one id must not be able to derive + * the ids handed out to other clients. * * @return a unique id */ - public synchronized String generateId() { - return this.seed + (this.sequence++); + public String generateId() { + return this.seed + UUID.randomUUID(); } /** diff --git a/services/wsn/wsn-core/src/test/java/org/apache/cxf/wsn/util/IdGeneratorTest.java b/services/wsn/wsn-core/src/test/java/org/apache/cxf/wsn/util/IdGeneratorTest.java new file mode 100644 index 00000000000..48a7a740d17 --- /dev/null +++ b/services/wsn/wsn-core/src/test/java/org/apache/cxf/wsn/util/IdGeneratorTest.java @@ -0,0 +1,55 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.cxf.wsn.util; + +import java.util.HashSet; +import java.util.Set; + +import org.junit.Test; + +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; + +public class IdGeneratorTest { + + @Test + public void testIdsAreNotSequential() { + IdGenerator generator = new IdGenerator(); + String first = generator.generateId(); + String second = generator.generateId(); + + // The variable part must not be a small sequential counter: a client seeing + // its own id must not be able to derive the ids handed out to other clients + String firstSuffix = first.substring(first.lastIndexOf(':') + 1); + String secondSuffix = second.substring(second.lastIndexOf(':') + 1); + assertFalse("id suffix must not be a bare counter", firstSuffix.matches("[0-9]+")); + assertFalse("id suffix must not be a bare counter", secondSuffix.matches("[0-9]+")); + assertTrue("id suffix must carry at least 122 bits of randomness", + firstSuffix.length() >= 32); + } + + @Test + public void testIdsAreUnique() { + IdGenerator generator = new IdGenerator(); + Set<String> ids = new HashSet<>(); + for (int i = 0; i < 1000; i++) { + assertTrue("duplicate id generated", ids.add(generator.generateSanitizedId())); + } + } +} \ No newline at end of file
