kali834x opened a new pull request, #1321: URL: https://github.com/apache/axis-axis2-java-core/pull/1321
the ?policy route in ListingAgent.handlePolicyRequest now writes the policy through the ExternalPolicySerializer it already builds with AxisConfiguration.getLocalPolicyAssertions() as its filter. the serializer was configured and never used: both the effective-policy branch (GET /services/<Service>?policy) and the by-id branch (?policy&id=<id>) called Policy.serialize(XMLStreamWriter) directly, so assertions a module lists under local-policy-assertions in its module.xml (ModuleBuilder: "These assertions are not exposed to the outside") were published anyway. Rampart lists RampartConfig there, and RampartConfig carries the service user, the password callback class and the signature/encryption crypto properties, keystore alias and keystore password included. the route is anonymous for any service whose metadata is exposed, and AxisService2WSDL11, AxisService2WSDL20 and WSDLSerializationUtil already embed policies through this filter, so ?wsdl withheld RampartConfig while ?policy ret urned it verbatim (CWE-200 / CWE-497). the response is now the normalized form the WSDL embedding uses: the same assertions, minus the local ones. PolicyListingFilterTest attaches a policy carrying a RampartConfig with a keystore password and fails before the change on both branches (the password is in the response) and passes after; the transport-http module build is green (113 tests, rat included). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
