[
https://issues.apache.org/jira/browse/CXF-9205?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andriy Redko updated CXF-9205:
------------------------------
Fix Version/s: 4.2.1
3.6.11
4.1.6
> The org.apache.cxf.binding.soap.interceptor.ReadHeadersInterceptor
> invalidates the signed SOAP Header elemements
> ----------------------------------------------------------------------------------------------------------------
>
> Key: CXF-9205
> URL: https://issues.apache.org/jira/browse/CXF-9205
> Project: CXF
> Issue Type: Bug
> Components: Bus, Soap Binding
> Affects Versions: 4.2.0, 3.5.11
> Reporter: Joze Rihtarsic
> Priority: Major
> Fix For: 4.2.1, 3.6.11, 4.1.6
>
> Attachments: image-2026-03-12-11-15-35-150.png
>
>
> The _*ReadHeadersInterceptor*_ modifies the SOAP message’s DOM structure by
> copying header attributes from the <S12:Header> elements onto each of its
> child elements. This behavior occurs in the code section around lines 233–248
> (cxf 4.2.0).
> !image-2026-03-12-11-15-35-150.png|width=892,height=343!
> Given an incoming message such as:
> {code:java}
> <S12:Envelope xmlns:S12="http://www.w3.org/2003/05/soap-envelope";
>
> xmlns:eb="http://docs.oasis-open.org/ebxml-msg/ebms/v3.0/ns/core/200704/";
>
> xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";>
> <S12:Header testAttribute="test attribute Value">
> <wsse:Security>
> ...
> </wsse:Security>
> <eb:Messaging id="_ebmessaging_N65541">
> ...
> </eb:Messaging>
> </S12:Header>
> <S12:Body>
> ...
> </S12:Body>
> </S12:Envelope>{code}
> the interceptor transforms it into:
> xml
> {code:java}
> <S12:Envelope xmlns:S12="http://www.w3.org/2003/05/soap-envelope";
>
> xmlns:eb="http://docs.oasis-open.org/ebxml-msg/ebms/v3.0/ns/core/200704/";
>
> xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";>
> <S12:Header testAttribute="test attribute Value">
> <wsse:Security testAttribute="test attribute Value">
> ...
> </wsse:Security>
> <eb:Messaging testAttribute="test attribute Value"
> id="_ebmessaging_N65541">
> ...
> </eb:Messaging>
> </S12:Header>
> <S12:Body>
> ...
> </S12:Body>
> </S12:Envelope>{code}
> When any of the header element is signed (e.g. in this case <eb:Messaging>),
> this modification changes the signed content. As a result, the
> WSS4JInInterceptor used for signature validation detects a mismatch and
> raises an Invalid Signature exception.
> The proposed fix is simply to remove the problematic block of code. The
> existing comment states:
> > // Need to add any attributes that are present on the parent element
> > // which otherwise would be lost.
> However, these attributes are not lost. They remain correctly attached to the
> <S12:Header> element. The interceptor unnecessarily duplicates them onto each
> child element, which leads to unintended side effects, to invalidate the
> signature of received message
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
