[PR] add missing parameter separator in createMethodSig [cxf]

["dxbjavid (via GitHub)" <gi...@apache.org>]

dxbjavid opened a new pull request, #3619:
URL: https://github.com/apache/cxf/pull/3619

   SimpleAuthorizingInterceptor.createMethodSig never writes the comma between parameter types, because first is only reset inside the branch that is never entered, so a methodRolesMap entry keyed by a full signature such as "void transfer(java.lang.String, long)" never matches. getExpectedRoles then falls back to the method name and globalRoles, and when neither is set the operation appears to need no roles at all, which seems to let any caller (anonymous ones included, by default) through to an overload the integrator meant to restrict. Moving the reset out of the branch gives the intended signature format, SecureAnnotationsInterceptor is unaffected since it builds and looks up its keys through the same method, and a regression test is added.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] add missing parameter separator in createMethodSig [cxf]

["reta (via GitHub)" <gi...@apache.org>]

reta merged PR #3619:
URL: https://github.com/apache/cxf/pull/3619


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org