You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2016/01/18 18:29:31 UTC
[1/2] cxf-fediz git commit: Some test reshuffling
Repository: cxf-fediz
Updated Branches:
refs/heads/1.2.x-fixes 85258b076 -> 7584a0c30
Some test reshuffling
Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/06d062b6
Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/06d062b6
Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/06d062b6
Branch: refs/heads/1.2.x-fixes
Commit: 06d062b6939cabdfe5275bbfe84337d37a9e8bd3
Parents: 85258b0
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Mon Jan 18 17:09:49 2016 +0000
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Mon Jan 18 17:28:27 2016 +0000
----------------------------------------------------------------------
systests/cxf/pom.xml | 1 +
.../apache/cxf/fediz/systests/idp/IdpTest.java | 4 +-
systests/jetty8/pom.xml | 1 +
systests/spring/pom.xml | 1 +
.../cxf/fediz/integrationtests/Spring2Test.java | 7 +
.../fediz/integrationtests/AbstractTests.java | 54 ++++
systests/tests/src/test/resources/entity.xml | 25 ++
systests/tomcat7/pom.xml | 1 +
.../EntityExpansionAttackTest.java | 247 -------------------
systests/tomcat7/src/test/resources/entity.xml | 25 --
10 files changed, 91 insertions(+), 275 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/06d062b6/systests/cxf/pom.xml
----------------------------------------------------------------------
diff --git a/systests/cxf/pom.xml b/systests/cxf/pom.xml
index 2df0611..3052d4b 100644
--- a/systests/cxf/pom.xml
+++ b/systests/cxf/pom.xml
@@ -92,6 +92,7 @@
<version>${project.version}</version>
<type>test-jar</type>
<scope>test</scope>
+ <classifier>tests</classifier>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/06d062b6/systests/idp/src/test/java/org/apache/cxf/fediz/systests/idp/IdpTest.java
----------------------------------------------------------------------
diff --git a/systests/idp/src/test/java/org/apache/cxf/fediz/systests/idp/IdpTest.java b/systests/idp/src/test/java/org/apache/cxf/fediz/systests/idp/IdpTest.java
index f9948f5..3a70ca9 100644
--- a/systests/idp/src/test/java/org/apache/cxf/fediz/systests/idp/IdpTest.java
+++ b/systests/idp/src/test/java/org/apache/cxf/fediz/systests/idp/IdpTest.java
@@ -20,7 +20,6 @@
package org.apache.cxf.fediz.systests.idp;
import java.io.File;
-import java.io.FileInputStream;
import java.net.URLEncoder;
import org.w3c.dom.Document;
@@ -286,8 +285,7 @@ public class IdpTest {
String wreply = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet";
url += "&wreply=" + wreply;
- FileInputStream is = new FileInputStream("src/test/resources/entity_wreq.xml");
- String entity = IOUtils.toString(is);
+ String entity = IOUtils.toString(this.getClass().getClassLoader().getResource("entity_wreq.xml").openStream());
String validWreq =
"<RequestSecurityToken xmlns=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\">"
+ "<TokenType>&m;http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</TokenType>"
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/06d062b6/systests/jetty8/pom.xml
----------------------------------------------------------------------
diff --git a/systests/jetty8/pom.xml b/systests/jetty8/pom.xml
index bf1e594..ba774a4 100644
--- a/systests/jetty8/pom.xml
+++ b/systests/jetty8/pom.xml
@@ -80,6 +80,7 @@
<version>${project.version}</version>
<type>test-jar</type>
<scope>test</scope>
+ <classifier>tests</classifier>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/06d062b6/systests/spring/pom.xml
----------------------------------------------------------------------
diff --git a/systests/spring/pom.xml b/systests/spring/pom.xml
index 23f89bd..1d9e457 100644
--- a/systests/spring/pom.xml
+++ b/systests/spring/pom.xml
@@ -92,6 +92,7 @@
<version>${project.version}</version>
<type>test-jar</type>
<scope>test</scope>
+ <classifier>tests</classifier>
</dependency>
<dependency>
<groupId>org.hsqldb</groupId>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/06d062b6/systests/spring/src/test/java/org/apache/cxf/fediz/integrationtests/Spring2Test.java
----------------------------------------------------------------------
diff --git a/systests/spring/src/test/java/org/apache/cxf/fediz/integrationtests/Spring2Test.java b/systests/spring/src/test/java/org/apache/cxf/fediz/integrationtests/Spring2Test.java
index 3bb2aa5..ed1acfe 100644
--- a/systests/spring/src/test/java/org/apache/cxf/fediz/integrationtests/Spring2Test.java
+++ b/systests/spring/src/test/java/org/apache/cxf/fediz/integrationtests/Spring2Test.java
@@ -107,4 +107,11 @@ public class Spring2Test extends AbstractTests {
public void testRPLogout() throws Exception {
}
+
+ @Override
+ @Test
+ @Ignore
+ public void testEntityExpansionAttack() throws Exception {
+
+ }
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/06d062b6/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
----------------------------------------------------------------------
diff --git a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java b/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
index 27cdc98..3648f5e 100644
--- a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
+++ b/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
@@ -35,6 +35,7 @@ import com.gargoylesoftware.htmlunit.html.HtmlPage;
import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
import com.gargoylesoftware.htmlunit.xml.XmlPage;
+import org.apache.commons.io.IOUtils;
import org.apache.cxf.fediz.core.ClaimTypes;
import org.apache.cxf.fediz.core.FederationConstants;
import org.apache.cxf.fediz.core.util.DOMUtils;
@@ -623,4 +624,57 @@ public abstract class AbstractTests {
}
}
+ @Test
+ public void testEntityExpansionAttack() throws Exception {
+ String url = "https://localhost:" + getRpHttpsPort() + "/fedizhelloworld/secure/fedservlet";
+ String user = "alice";
+ String password = "ecila";
+
+ // Get the initial token
+ CookieManager cookieManager = new CookieManager();
+ final WebClient webClient = new WebClient();
+ webClient.setCookieManager(cookieManager);
+ webClient.getOptions().setUseInsecureSSL(true);
+ webClient.getCredentialsProvider().setCredentials(
+ new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
+ new UsernamePasswordCredentials(user, password));
+
+ webClient.getOptions().setJavaScriptEnabled(false);
+ final HtmlPage idpPage = webClient.getPage(url);
+ webClient.getOptions().setJavaScriptEnabled(true);
+ Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText());
+
+ // Parse the form to get the token (wresult)
+ DomNodeList<DomElement> results = idpPage.getElementsByTagName("input");
+
+ String entity = IOUtils.toString(this.getClass().getClassLoader().getResource("entity.xml").openStream());
+ String reference = "&m;";
+
+ for (DomElement result : results) {
+ if ("wresult".equals(result.getAttributeNS(null, "name"))) {
+ // Now modify the Signature
+ String value = result.getAttributeNS(null, "value");
+ value = entity + value;
+ value = value.replace("alice", reference);
+ result.setAttributeNS(null, "value", value);
+ }
+ }
+
+ // Invoke back on the RP
+
+ final HtmlForm form = idpPage.getFormByName("signinresponseform");
+ final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
+
+ try {
+ button.click();
+ Assert.fail("Failure expected on an entity expansion attack");
+ } catch (FailingHttpStatusCodeException ex) {
+ ex.printStackTrace();
+ // expected
+ Assert.assertTrue(ex.getMessage().contains("401 Unauthorized")
+ || ex.getMessage().contains("401 Authentication Failed")
+ || ex.getMessage().contains("403 Forbidden"));
+ }
+ }
+
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/06d062b6/systests/tests/src/test/resources/entity.xml
----------------------------------------------------------------------
diff --git a/systests/tests/src/test/resources/entity.xml b/systests/tests/src/test/resources/entity.xml
new file mode 100644
index 0000000..373b575
--- /dev/null
+++ b/systests/tests/src/test/resources/entity.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE RequestSecurityTokenResponseCollection [<!ENTITY a "1234567890" >
+
+<!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;" >
+
+<!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;" >
+
+<!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;" >
+
+<!ENTITY e "&d;&d;&d;&d;&d;&d;&d;&d;" >
+
+<!ENTITY f "&e;&e;&e;&e;&e;&e;&e;&e;" >
+
+<!ENTITY g "&f;&f;&f;&f;&f;&f;&f;&f;" >
+
+<!ENTITY h "&g;&g;&g;&g;&g;&g;&g;&g;" >
+
+<!ENTITY i "&h;&h;&h;&h;&h;&h;&h;&h;" >
+
+<!ENTITY j "&i;&i;&i;&i;&i;&i;&i;&i;" >
+
+<!ENTITY k "&j;&j;&j;&j;&j;&j;&j;&j;" >
+
+<!ENTITY l "&k;&k;&k;&k;&k;&k;&k;&k;" >
+
+<!ENTITY m "&l;&l;&l;&l;&l;&l;&l;&l;" > ]>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/06d062b6/systests/tomcat7/pom.xml
----------------------------------------------------------------------
diff --git a/systests/tomcat7/pom.xml b/systests/tomcat7/pom.xml
index 464d17d..b9cab72 100644
--- a/systests/tomcat7/pom.xml
+++ b/systests/tomcat7/pom.xml
@@ -76,6 +76,7 @@
<version>${project.version}</version>
<type>test-jar</type>
<scope>test</scope>
+ <classifier>tests</classifier>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/06d062b6/systests/tomcat7/src/test/java/org/apache/cxf/fediz/integrationtests/EntityExpansionAttackTest.java
----------------------------------------------------------------------
diff --git a/systests/tomcat7/src/test/java/org/apache/cxf/fediz/integrationtests/EntityExpansionAttackTest.java b/systests/tomcat7/src/test/java/org/apache/cxf/fediz/integrationtests/EntityExpansionAttackTest.java
deleted file mode 100644
index 006fa2a..0000000
--- a/systests/tomcat7/src/test/java/org/apache/cxf/fediz/integrationtests/EntityExpansionAttackTest.java
+++ /dev/null
@@ -1,247 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.cxf.fediz.integrationtests;
-
-
-import java.io.File;
-import java.io.FileInputStream;
-
-import com.gargoylesoftware.htmlunit.CookieManager;
-import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
-import com.gargoylesoftware.htmlunit.WebClient;
-import com.gargoylesoftware.htmlunit.html.DomElement;
-import com.gargoylesoftware.htmlunit.html.DomNodeList;
-import com.gargoylesoftware.htmlunit.html.HtmlForm;
-import com.gargoylesoftware.htmlunit.html.HtmlPage;
-import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
-
-import org.apache.catalina.Context;
-import org.apache.catalina.LifecycleState;
-import org.apache.catalina.connector.Connector;
-import org.apache.catalina.startup.Tomcat;
-import org.apache.commons.io.IOUtils;
-import org.apache.cxf.fediz.tomcat.FederationAuthenticator;
-import org.apache.http.auth.AuthScope;
-import org.apache.http.auth.UsernamePasswordCredentials;
-import org.junit.AfterClass;
-import org.junit.Assert;
-import org.junit.BeforeClass;
-import org.junit.Test;
-
-public class EntityExpansionAttackTest {
-
- static String idpHttpsPort;
- static String rpHttpsPort;
-
- private static Tomcat idpServer;
- private static Tomcat rpServer;
-
- @BeforeClass
- public static void init() {
- System.setProperty("org.apache.commons.logging.Log", "org.apache.commons.logging.impl.SimpleLog");
- System.setProperty("org.apache.commons.logging.simplelog.showdatetime", "true");
- System.setProperty("org.apache.commons.logging.simplelog.log.httpclient.wire", "info");
- System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.commons.httpclient", "info");
- System.setProperty("org.apache.commons.logging.simplelog.log.org.springframework.webflow", "info");
- System.setProperty("org.apache.commons.logging.simplelog.log.org.springframework.security.web", "info");
- System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.cxf.fediz", "info");
- System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.cxf", "info");
-
- idpHttpsPort = System.getProperty("idp.https.port");
- Assert.assertNotNull("Property 'idp.https.port' null", idpHttpsPort);
- rpHttpsPort = System.getProperty("rp.https.port");
- Assert.assertNotNull("Property 'rp.https.port' null", rpHttpsPort);
-
- initIdp();
- initRp();
- }
-
- private static void initIdp() {
- try {
- idpServer = new Tomcat();
- idpServer.setPort(0);
- String currentDir = new File(".").getCanonicalPath();
- idpServer.setBaseDir(currentDir + File.separator + "target");
-
- idpServer.getHost().setAppBase("tomcat/idp/webapps");
- idpServer.getHost().setAutoDeploy(true);
- idpServer.getHost().setDeployOnStartup(true);
-
- Connector httpsConnector = new Connector();
- httpsConnector.setPort(Integer.parseInt(idpHttpsPort));
- httpsConnector.setSecure(true);
- httpsConnector.setScheme("https");
- //httpsConnector.setAttribute("keyAlias", keyAlias);
- httpsConnector.setAttribute("keystorePass", "tompass");
- httpsConnector.setAttribute("keystoreFile", "test-classes/server.jks");
- httpsConnector.setAttribute("truststorePass", "tompass");
- httpsConnector.setAttribute("truststoreFile", "test-classes/server.jks");
- httpsConnector.setAttribute("clientAuth", "want");
- // httpsConnector.setAttribute("clientAuth", "false");
- httpsConnector.setAttribute("sslProtocol", "TLS");
- httpsConnector.setAttribute("SSLEnabled", true);
-
- idpServer.getService().addConnector(httpsConnector);
-
- idpServer.addWebapp("/fediz-idp-sts", "fediz-idp-sts");
- idpServer.addWebapp("/fediz-idp", "fediz-idp");
-
- idpServer.start();
- } catch (Exception e) {
- e.printStackTrace();
- }
- }
-
- private static void initRp() {
- try {
- rpServer = new Tomcat();
- rpServer.setPort(0);
- String currentDir = new File(".").getCanonicalPath();
- rpServer.setBaseDir(currentDir + File.separator + "target");
-
- rpServer.getHost().setAppBase("tomcat/rp/webapps");
- rpServer.getHost().setAutoDeploy(true);
- rpServer.getHost().setDeployOnStartup(true);
-
- Connector httpsConnector = new Connector();
- httpsConnector.setPort(Integer.parseInt(rpHttpsPort));
- httpsConnector.setSecure(true);
- httpsConnector.setScheme("https");
- //httpsConnector.setAttribute("keyAlias", keyAlias);
- httpsConnector.setAttribute("keystorePass", "tompass");
- httpsConnector.setAttribute("keystoreFile", "test-classes/server.jks");
- httpsConnector.setAttribute("truststorePass", "tompass");
- httpsConnector.setAttribute("truststoreFile", "test-classes/server.jks");
- // httpsConnector.setAttribute("clientAuth", "false");
- httpsConnector.setAttribute("clientAuth", "want");
- httpsConnector.setAttribute("sslProtocol", "TLS");
- httpsConnector.setAttribute("SSLEnabled", true);
-
- rpServer.getService().addConnector(httpsConnector);
-
- //Context ctx =
- Context cxt = rpServer.addWebapp("/fedizhelloworld", "simpleWebapp");
- FederationAuthenticator fa = new FederationAuthenticator();
- fa.setConfigFile(currentDir + File.separator + "target" + File.separator
- + "test-classes" + File.separator + "fediz_config_wreq.xml");
- cxt.getPipeline().addValve(fa);
-
-
- rpServer.start();
- } catch (Exception e) {
- e.printStackTrace();
- }
- }
-
- @AfterClass
- public static void cleanup() {
- try {
- if (idpServer.getServer() != null
- && idpServer.getServer().getState() != LifecycleState.DESTROYED) {
- if (idpServer.getServer().getState() != LifecycleState.STOPPED) {
- idpServer.stop();
- }
- idpServer.destroy();
- }
- } catch (Exception e) {
- e.printStackTrace();
- }
-
- try {
- if (rpServer.getServer() != null
- && rpServer.getServer().getState() != LifecycleState.DESTROYED) {
- if (rpServer.getServer().getState() != LifecycleState.STOPPED) {
- rpServer.stop();
- }
- rpServer.destroy();
- }
- } catch (Exception e) {
- e.printStackTrace();
- }
- }
-
- public String getIdpHttpsPort() {
- return idpHttpsPort;
- }
-
- public String getRpHttpsPort() {
- return rpHttpsPort;
- }
-
- public String getServletContextName() {
- return "fedizhelloworld";
- }
-
- @Test
- public void testEntityExpansionAttack() throws Exception {
- String url = "https://localhost:" + getRpHttpsPort() + "/fedizhelloworld/secure/fedservlet";
- String user = "alice";
- String password = "ecila";
-
- // Get the initial token
- CookieManager cookieManager = new CookieManager();
- final WebClient webClient = new WebClient();
- webClient.setCookieManager(cookieManager);
- webClient.getOptions().setUseInsecureSSL(true);
- webClient.getCredentialsProvider().setCredentials(
- new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
- new UsernamePasswordCredentials(user, password));
-
- webClient.getOptions().setJavaScriptEnabled(false);
- final HtmlPage idpPage = webClient.getPage(url);
- webClient.getOptions().setJavaScriptEnabled(true);
- Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText());
-
- // Parse the form to get the token (wresult)
- DomNodeList<DomElement> results = idpPage.getElementsByTagName("input");
-
- FileInputStream is = new FileInputStream("src/test/resources/entity.xml");
- String entity = IOUtils.toString(is);
- String reference = "&m;";
-
- for (DomElement result : results) {
- if ("wresult".equals(result.getAttributeNS(null, "name"))) {
- // Now modify the Signature
- String value = result.getAttributeNS(null, "value");
- value = entity + value;
- value = value.replace("alice", reference);
- result.setAttributeNS(null, "value", value);
- }
- }
-
- // Invoke back on the RP
-
- final HtmlForm form = idpPage.getFormByName("signinresponseform");
- final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
-
- try {
- button.click();
- Assert.fail("Failure expected on an entity expansion attack");
- } catch (FailingHttpStatusCodeException ex) {
- ex.printStackTrace();
- // expected
- Assert.assertTrue(ex.getMessage().contains("401 Unauthorized")
- || ex.getMessage().contains("401 Authentication Failed")
- || ex.getMessage().contains("403 Forbidden"));
- }
-
- }
-
-}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/06d062b6/systests/tomcat7/src/test/resources/entity.xml
----------------------------------------------------------------------
diff --git a/systests/tomcat7/src/test/resources/entity.xml b/systests/tomcat7/src/test/resources/entity.xml
deleted file mode 100644
index c0ff502..0000000
--- a/systests/tomcat7/src/test/resources/entity.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE RequestSecurityTokenResponseCollection [<!ENTITY a "1234567890" >
-
-<!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;" >
-
-<!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;" >
-
-<!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;" >
-
-<!ENTITY e "&d;&d;&d;&d;&d;&d;&d;&d;" >
-
-<!ENTITY f "&e;&e;&e;&e;&e;&e;&e;&e;" >
-
-<!ENTITY g "&f;&f;&f;&f;&f;&f;&f;&f;" >
-
-<!ENTITY h "&g;&g;&g;&g;&g;&g;&g;&g;" >
-
-<!ENTITY i "&h;&h;&h;&h;&h;&h;&h;&h;" >
-
-<!ENTITY j "&i;&i;&i;&i;&i;&i;&i;&i;" >
-
-<!ENTITY k "&j;&j;&j;&j;&j;&j;&j;&j;" >
-
-<!ENTITY l "&k;&k;&k;&k;&k;&k;&k;&k;" >
-
-<!ENTITY m "&l;&l;&l;&l;&l;&l;&l;&l;" > ]>
\ No newline at end of file
[2/2] cxf-fediz git commit: Minor changes
Posted by co...@apache.org.
Minor changes
Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/7584a0c3
Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/7584a0c3
Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/7584a0c3
Branch: refs/heads/1.2.x-fixes
Commit: 7584a0c30c9f8fddfff52560d8db884a73b00451
Parents: 06d062b
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Mon Jan 18 17:26:35 2016 +0000
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Mon Jan 18 17:28:52 2016 +0000
----------------------------------------------------------------------
.../apache/cxf/fediz/integrationtests/AbstractTests.java | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/7584a0c3/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
----------------------------------------------------------------------
diff --git a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java b/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
index 3648f5e..c008556 100644
--- a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
+++ b/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
@@ -48,12 +48,7 @@ import org.junit.Assert;
import org.junit.Test;
public abstract class AbstractTests {
-
- static final String TEST_WREQ =
- "<RequestSecurityToken xmlns=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\">"
- + "<TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV3.0</TokenType>"
- + "</RequestSecurityToken>";
-
+
static {
WSSConfig.init();
}
@@ -626,7 +621,7 @@ public abstract class AbstractTests {
@Test
public void testEntityExpansionAttack() throws Exception {
- String url = "https://localhost:" + getRpHttpsPort() + "/fedizhelloworld/secure/fedservlet";
+ String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet";
String user = "alice";
String password = "ecila";