kali834x opened a new pull request, #1319: URL: https://github.com/apache/axis-axis2-java-core/pull/1319
jsonbaseddefaultdispatcher.findService picks the service from the namespace of the soap body's first element. that is the content-based dispatch SOAPMessageBodyBasedDispatcher and SOAPMessageBodyBasedServiceDispatcher now refuse unless allowContentBasedServiceDispatch is set (ContentBasedDispatchPolicy), because Dispatch runs after the Security phase. the json copy of that code kept the old behaviour, and it is the only Dispatch-phase dispatcher in the spring-boot-starter axis2-json.xml, whose application/xml builder puts the caller's root element in the body: a POST whose uri names no service, carrying <x:a xmlns:x="http://h/axis2/services/Target"/>, binds Target after Security has already run against no service. apply the same policy check at the top of findService. json-rpc requests carry an empty body, so their dispatch is unchanged. JSONBasedDefaultDispatcherTest fails before the change; the kernel, json and spring-boot-starter tests pass after. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
