Author: coheigea
Date: Wed Nov 27 12:01:10 2013
New Revision: 1546004
URL: http://svn.apache.org/r1546004
Log:
Avoid NPE if a signed Assertion does not have a KeyInfo Element
Modified:
webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/wss4j/common/saml/SamlAssertionWrapper.java
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/processor/SAMLTokenProcessor.java
Modified:
webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/wss4j/common/saml/SamlAssertionWrapper.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/wss4j/common/saml/SamlAssertionWrapper.java?rev=1546004&r1=1546003&r2=1546004&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/wss4j/common/saml/SamlAssertionWrapper.java
(original)
+++
webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/wss4j/common/saml/SamlAssertionWrapper.java
Wed Nov 27 12:01:10 2013
@@ -542,6 +542,12 @@ public class SamlAssertionWrapper {
Signature sig = getSignature();
if (sig != null) {
KeyInfo keyInfo = sig.getKeyInfo();
+ if (keyInfo == null) {
+ throw new WSSecurityException(
+ WSSecurityException.ErrorCode.FAILURE,
"invalidSAMLsecurity",
+ "cannot get certificate or key"
+ );
+ }
SAMLKeyInfo samlKeyInfo =
SAMLUtil.getCredentialDirectlyFromKeyInfo(keyInfo.getDOM(),
sigCrypto);
verifySignature(samlKeyInfo);
Modified:
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/processor/SAMLTokenProcessor.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/processor/SAMLTokenProcessor.java?rev=1546004&r1=1546003&r2=1546004&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/processor/SAMLTokenProcessor.java
(original)
+++
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/processor/SAMLTokenProcessor.java
Wed Nov 27 12:01:10 2013
@@ -137,6 +137,12 @@ public class SAMLTokenProcessor implemen
Signature sig = samlAssertion.getSignature();
KeyInfo keyInfo = sig.getKeyInfo();
+ if (keyInfo == null) {
+ throw new WSSecurityException(
+ WSSecurityException.ErrorCode.FAILURE,
"invalidSAMLsecurity",
+ "cannot get certificate or key"
+ );
+ }
SAMLKeyInfo samlKeyInfo =
SAMLUtil.getCredentialDirectlyFromKeyInfo(
keyInfo.getDOM(), data.getSigVerCrypto()
