gregjotau opened a new pull request, #653: URL: https://github.com/apache/ws-wss4j/pull/653
## What this changes - Replaces the direct Bouncy Castle ASN.1 use for X.509 AuthorityKeyIdentifier and SubjectKeyIdentifier extraction with WSS4J's existing `DERDecoder`. - Retains the historical `BouncyCastleUtils` class name and all public method signatures for binary/source compatibility. - Hardens `DERDecoder` against out-of-bounds skips/reads and overflowing or unsupported length fields while making its documented indefinite-length result explicit. ## Compatibility The existing return behavior is preserved: - a missing extension returns an empty byte array; - an AuthorityKeyIdentifier extension without a key identifier returns `null`; - malformed extension data still surfaces as `IllegalArgumentException` from `BouncyCastleUtils`. This does not remove WSS4J's optional BC provider support or change its SAML/OpenSAML dependencies. It removes the direct BC linkage from the standard X.509 key-identifier path, which is useful independently and is a prerequisite for downstream applications that want a provider-neutral runtime. ## Verification - `mvn -pl ws-security-common -am verify` passed for the full three-project reactor. - Full `ws-security-common` suite: 4,088 tests, 0 failures/errors/skips. - Existing real-certificate AKI/SKI extraction and `MerlinAKI` trust verification remain green. - Added focused bounds/length tests for `DERDecoder`. - Added an isolated classloader test that loads real `wss40` and CA JKS certificates, deliberately hides `org.bouncycastle.*`, and verifies the certificate AKI equals the issuer SKI. - PMD, Checkstyle, compiler/Error Prone, packaging, and CycloneDX steps pass. - Production source has no direct `org.bouncycastle` imports, and compiled `ws-security-common` classes contain no `org/bouncycastle` bytecode references. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
