You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ws.apache.org by co...@apache.org on 2013/07/25 13:07:16 UTC
svn commit: r1506884 - in /webservices/wss4j/trunk/ws-security-stax/src:
main/java/org/apache/wss4j/stax/ext/ test/java/org/apache/wss4j/stax/test/
test/java/org/apache/wss4j/stax/test/saml/
Author: coheigea
Date: Thu Jul 25 11:07:15 2013
New Revision: 1506884
URL: http://svn.apache.org/r1506884
Log:
Allow to pass a List of SecurityEventListeners to the inbound security context
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/InboundWSSec.java
webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/PasswordTypeTest.java
webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/SignatureConfirmationTest.java
webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/UsernameTokenTest.java
webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenHOKTest.java
webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenSVTest.java
Modified: webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/InboundWSSec.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/InboundWSSec.java?rev=1506884&r1=1506883&r2=1506884&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/InboundWSSec.java (original)
+++ webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/InboundWSSec.java Thu Jul 25 11:07:15 2013
@@ -94,7 +94,7 @@ public class InboundWSSec {
*/
public XMLStreamReader processInMessage(
XMLStreamReader xmlStreamReader) throws XMLStreamException, WSSecurityException {
- return this.processInMessage(xmlStreamReader, null, null);
+ return this.processInMessage(xmlStreamReader, null, (SecurityEventListener)null);
}
/**
@@ -110,6 +110,29 @@ public class InboundWSSec {
* Hand over the original XMLStreamReader and use the returned one for further processing
*
* @param xmlStreamReader The original XMLStreamReader
+ * @return A new XMLStreamReader which does transparently the security processing.
+ * @throws XMLStreamException thrown when a streaming error occurs
+ * @throws XMLSecurityException
+ */
+ public XMLStreamReader processInMessage(
+ XMLStreamReader xmlStreamReader, List<SecurityEvent> requestSecurityEvents
+ ) throws XMLStreamException, WSSecurityException {
+ return this.processInMessage(xmlStreamReader, requestSecurityEvents, (SecurityEventListener)null);
+ }
+
+ /**
+ * Warning:
+ * configure your xmlStreamReader correctly. Otherwise you can create a security hole.
+ * At minimum configure the following properties:
+ * xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+ * xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+ * xmlInputFactory.setProperty(XMLInputFactory.IS_COALESCING, false);
+ * xmlInputFactory.setProperty(WstxInputProperties.P_MIN_TEXT_SEGMENT, new Integer(8192));
+ * <p/>
+ * This method is the entry point for the incoming security-engine.
+ * Hand over the original XMLStreamReader and use the returned one for further processing
+ *
+ * @param xmlStreamReader The original XMLStreamReader
* @param securityEventListener A SecurityEventListener to receive security-relevant events.
* @return A new XMLStreamReader which does transparently the security processing.
* @throws XMLStreamException thrown when a streaming error occurs
@@ -118,6 +141,30 @@ public class InboundWSSec {
public XMLStreamReader processInMessage(
XMLStreamReader xmlStreamReader, List<SecurityEvent> requestSecurityEvents,
SecurityEventListener securityEventListener) throws XMLStreamException, WSSecurityException {
+ return this.processInMessage(xmlStreamReader, requestSecurityEvents,
+ Collections.singletonList(securityEventListener));
+ }
+ /**
+ * Warning:
+ * configure your xmlStreamReader correctly. Otherwise you can create a security hole.
+ * At minimum configure the following properties:
+ * xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+ * xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+ * xmlInputFactory.setProperty(XMLInputFactory.IS_COALESCING, false);
+ * xmlInputFactory.setProperty(WstxInputProperties.P_MIN_TEXT_SEGMENT, new Integer(8192));
+ * <p/>
+ * This method is the entry point for the incoming security-engine.
+ * Hand over the original XMLStreamReader and use the returned one for further processing
+ *
+ * @param xmlStreamReader The original XMLStreamReader
+ * @param securityEventListeners A list of SecurityEventListeners to receive security-relevant events.
+ * @return A new XMLStreamReader which does transparently the security processing.
+ * @throws XMLStreamException thrown when a streaming error occurs
+ * @throws XMLSecurityException
+ */
+ public XMLStreamReader processInMessage(
+ XMLStreamReader xmlStreamReader, List<SecurityEvent> requestSecurityEvents,
+ List<SecurityEventListener> securityEventListeners) throws XMLStreamException, WSSecurityException {
if (requestSecurityEvents == null) {
requestSecurityEvents = Collections.emptyList();
@@ -125,7 +172,11 @@ public class InboundWSSec {
final InboundWSSecurityContextImpl securityContextImpl = new InboundWSSecurityContextImpl();
securityContextImpl.putList(SecurityEvent.class, requestSecurityEvents);
- securityContextImpl.addSecurityEventListener(securityEventListener);
+ if (securityEventListeners != null) {
+ for (SecurityEventListener securityEventListener : securityEventListeners) {
+ securityContextImpl.addSecurityEventListener(securityEventListener);
+ }
+ }
securityContextImpl.ignoredBSPRules(this.securityProperties.getIgnoredBSPRules());
securityContextImpl.setDisableBSPEnforcement(this.securityProperties.isDisableBSPEnforcement());
securityContextImpl.setAllowRSA15KeyTransportAlgorithm(this.securityProperties.isAllowRSA15KeyTransportAlgorithm());
Modified: webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/PasswordTypeTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/PasswordTypeTest.java?rev=1506884&r1=1506883&r2=1506884&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/PasswordTypeTest.java (original)
+++ webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/PasswordTypeTest.java Thu Jul 25 11:07:15 2013
@@ -76,7 +76,7 @@ public class PasswordTypeTest extends Ab
securityProperties.setUsernameTokenPasswordType(WSSConstants.UsernameTokenPasswordType.PASSWORD_DIGEST);
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
- XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null, null);
+ XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null);
StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
}
@@ -88,7 +88,7 @@ public class PasswordTypeTest extends Ab
securityProperties.setUsernameTokenPasswordType(null);
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
- XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null, null);
+ XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null);
StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
}
@@ -100,7 +100,7 @@ public class PasswordTypeTest extends Ab
securityProperties.setUsernameTokenPasswordType(WSSConstants.UsernameTokenPasswordType.PASSWORD_TEXT);
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
- XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null, null);
+ XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null);
try {
StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
@@ -143,7 +143,7 @@ public class PasswordTypeTest extends Ab
securityProperties.setUsernameTokenPasswordType(WSSConstants.UsernameTokenPasswordType.PASSWORD_TEXT);
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
- XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null, null);
+ XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null);
StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
}
@@ -155,7 +155,7 @@ public class PasswordTypeTest extends Ab
securityProperties.setUsernameTokenPasswordType(null);
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
- XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null, null);
+ XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null);
StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
}
@@ -167,7 +167,7 @@ public class PasswordTypeTest extends Ab
securityProperties.setUsernameTokenPasswordType(WSSConstants.UsernameTokenPasswordType.PASSWORD_DIGEST);
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
- XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null, null);
+ XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null);
try {
StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
Modified: webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/SignatureConfirmationTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/SignatureConfirmationTest.java?rev=1506884&r1=1506883&r2=1506884&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/SignatureConfirmationTest.java (original)
+++ webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/SignatureConfirmationTest.java Thu Jul 25 11:07:15 2013
@@ -313,7 +313,7 @@ public class SignatureConfirmationTest e
xmlInputFactory.createXMLStreamReader(
new ByteArrayInputStream(baos.toByteArray())
),
- securityEventList, null);
+ securityEventList);
Document document = StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
@@ -397,7 +397,7 @@ public class SignatureConfirmationTest e
securityProperties.loadSignatureVerificationKeystore(this.getClass().getClassLoader().getResource("transmitter.jks"), "default".toCharArray());
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
- XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), securityEventList, null);
+ XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), securityEventList);
try {
StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
Modified: webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/UsernameTokenTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/UsernameTokenTest.java?rev=1506884&r1=1506883&r2=1506884&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/UsernameTokenTest.java (original)
+++ webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/UsernameTokenTest.java Thu Jul 25 11:07:15 2013
@@ -594,7 +594,7 @@ public class UsernameTokenTest extends A
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
XMLStreamReader xmlStreamReader =
- wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null, null);
+ wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null);
Document document = StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
@@ -697,7 +697,7 @@ public class UsernameTokenTest extends A
securityProperties.setCallbackHandler(new CallbackHandlerImpl());
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
- XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null, null);
+ XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())), null);
Document document = StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
Modified: webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenHOKTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenHOKTest.java?rev=1506884&r1=1506883&r2=1506884&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenHOKTest.java (original)
+++ webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenHOKTest.java Thu Jul 25 11:07:15 2013
@@ -564,7 +564,7 @@ public class SAMLTokenHOKTest extends Ab
XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(
xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())),
- requestSecurityEvents, null);
+ requestSecurityEvents);
Document document = StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
Modified: webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenSVTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenSVTest.java?rev=1506884&r1=1506883&r2=1506884&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenSVTest.java (original)
+++ webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenSVTest.java Thu Jul 25 11:07:15 2013
@@ -363,7 +363,7 @@ public class SAMLTokenSVTest extends Abs
XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(
xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())),
- requestSecurityEvents, null);
+ requestSecurityEvents);
Document document = StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);