[cxf] branch master updated: CXF-8280 - Also try URL decoding when trying to match attachments in WS-Security.

[co...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/master by this push:
     new 909190a  CXF-8280 - Also try URL decoding when trying to match attachments in WS-Security.
909190a is described below

commit 909190a8cfca065c507aa03107cace89b0d3e713
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Fri May 8 13:03:25 2020 +0100

    CXF-8280 - Also try URL decoding when trying to match attachments in WS-Security.
---
 .../security/wss4j/AttachmentCallbackHandler.java  | 12 ++-
 .../wss4j/AttachmentCallbackHandlerTest.java       | 87 ++++++++++++++++++++++
 2 files changed, 97 insertions(+), 2 deletions(-)

diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/AttachmentCallbackHandler.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/AttachmentCallbackHandler.java
index fae53c4..25abcd5 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/AttachmentCallbackHandler.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/AttachmentCallbackHandler.java
@@ -20,6 +20,8 @@
 package org.apache.cxf.ws.security.wss4j;
 
 import java.io.IOException;
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Iterator;
@@ -124,14 +126,16 @@ public class AttachmentCallbackHandler implements CallbackHandler {
                 iterator.hasNext();) {
                 org.apache.cxf.message.Attachment attachment = iterator.next();
 
-                if (attachmentId != null && !attachmentId.equals(attachment.getId())) {
+                if (attachmentId != null
+                        && !(attachmentId.equals(attachment.getId())
+                            || attachmentId.equals(getDecodedAttachmentId(attachment.getId())))) {
                     continue;
                 }
 
                 org.apache.wss4j.common.ext.Attachment att =
                     new org.apache.wss4j.common.ext.Attachment();
                 att.setMimeType(attachment.getDataHandler().getContentType());
-                att.setId(attachment.getId());
+                att.setId(attachmentId == null ? attachment.getId() : attachmentId);
                 att.setSourceStream(attachment.getDataHandler().getInputStream());
                 Iterator<String> headerIterator = attachment.getHeaderNames();
                 while (headerIterator.hasNext()) {
@@ -147,4 +151,8 @@ public class AttachmentCallbackHandler implements CallbackHandler {
         }
     }
 
+    private static String getDecodedAttachmentId(String attachmentId) throws IOException {
+        return URLDecoder.decode(attachmentId, StandardCharsets.UTF_8.name());
+    }
+
 }
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/AttachmentCallbackHandlerTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/AttachmentCallbackHandlerTest.java
new file mode 100644
index 0000000..2273dcc
--- /dev/null
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/AttachmentCallbackHandlerTest.java
@@ -0,0 +1,87 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.ws.security.wss4j;
+
+
+import java.util.Collections;
+import java.util.List;
+
+import javax.activation.CommandMap;
+import javax.activation.DataHandler;
+import javax.security.auth.callback.Callback;
+
+import org.apache.cxf.attachment.AttachmentImpl;
+import org.apache.cxf.message.Attachment;
+import org.apache.wss4j.common.ext.AttachmentRequestCallback;
+import org.apache.wss4j.common.util.AttachmentUtils;
+import org.apache.wss4j.dom.engine.WSSConfig;
+
+import org.easymock.EasyMock;
+import org.junit.Test;
+
+import static org.easymock.EasyMock.anyObject;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+
+public class AttachmentCallbackHandlerTest {
+
+    static {
+        WSSConfig.init();
+    }
+
+    @Test
+    public void testUnencodedAttachmentId() throws Exception {
+        String attachmentId = "998c3362-5b5f-405a-817a-b20f8373c378-5@urn:be:cin:nip:async:generic";
+        parseAttachment(attachmentId);
+    }
+
+    @Test
+    public void testEncodedAttachmentId() throws Exception {
+        String attachmentId = "998c3362-5b5f-405a-817a-b20f8373c378-5@urn%3Abe%3Acin%3Anip%3Aasync%3Ageneric";
+        parseAttachment(attachmentId);
+    }
+
+    private void parseAttachment(String attachmentId) throws Exception {
+        Attachment attachment = new AttachmentImpl(attachmentId);
+
+        // Mock up a DataHandler for the Attachment
+        DataHandler dataHandler = EasyMock.mock(DataHandler.class);
+        dataHandler.setCommandMap(anyObject(CommandMap.class));
+        EasyMock.expectLastCall();
+        EasyMock.expect(dataHandler.getInputStream()).andReturn(null);
+        EasyMock.expect(dataHandler.getContentType()).andReturn(null);
+        EasyMock.replay(dataHandler);
+
+        ((AttachmentImpl)attachment).setDataHandler(dataHandler);
+        AttachmentCallbackHandler callbackHandler =
+                new AttachmentCallbackHandler(Collections.singletonList(attachment));
+
+        AttachmentRequestCallback attachmentRequestCallback = new AttachmentRequestCallback();
+        attachmentRequestCallback.setAttachmentId(AttachmentUtils.getAttachmentId("cid:" + attachmentId));
+        attachmentRequestCallback.setRemoveAttachments(false);
+
+        callbackHandler.handle(new Callback[]{attachmentRequestCallback});
+
+        List<org.apache.wss4j.common.ext.Attachment> attachments = attachmentRequestCallback.getAttachments();
+        assertNotNull(attachments);
+        assertEquals(1, attachments.size());
+        EasyMock.verify(dataHandler);
+    }
+
+}