[
https://issues.apache.org/jira/browse/CXF-2638?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12828660#action_12828660
]
Daniel Kulp commented on CXF-2638:
----------------------------------
There are a bunch of missing files in this patch which is causing the new tests
to fail.
org/apache/cxf/ws/security/wss4j/PolicyBasedWss4JInOutTest_bus_context.xml
signed_missing_signed_body.xml
encrypted_missing_enc_header.xml
encrypted_body_element.xml
encrypted_missing_enc_body.xml
encrypted_body_content.xml
et.c.....
Can you recreate the patch making sure all the files are "added" first?
Thanks!
> WS-SecurityPolicy SignedElements, SignedParts, EncryptedParts,
> EncryptedElements, and ContentEncryptedElements assertions incorrectly
> verified
> ----------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CXF-2638
> URL: https://issues.apache.org/jira/browse/CXF-2638
> Project: CXF
> Issue Type: Bug
> Components: WS-* Components
> Affects Versions: 2.3
> Reporter: David Valeri
> Assignee: Daniel Kulp
> Attachments: cxf-2638.patch
>
>
> When security configuration is provided via WS-SecurityPolicy, the
> PolicyBasedWSS4JInInterceptor enforces the SignedElements assertion
> incorrectly. If there is more than one match to the assertion XPath, the
> validation code does not correctly detect the unsigned matches so long as any
> one of the matches is signed. This logic does not accurately reflect the case
> in which multiple matches for the signature coverage XPath exist in the
> message and may provide a false sense of integrity in the message.
> Per section 1.2 of the WS-Security spec:
> The XPath expression "identifies the nodes to be integrity protected."
> Based on this language, it seems as if all nodes matching the XPath
> expression must be integrity constrained.
> Similar issues exist with the SignedParts, EncryptedParts, EncryptedElements,
> and ContentEncryptedElements assertions as well.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
