svn commit: r1673719 - /webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/processor/SignatureProcessor.java

[co...@apache.org]

Author: coheigea
Date: Wed Apr 15 10:32:22 2015
New Revision: 1673719

URL: http://svn.apache.org/r1673719
Log:
[WSS-533] - Also use signing key when trying to detect message replay attacks

Modified:
    webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/processor/SignatureProcessor.java

Modified: webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/processor/SignatureProcessor.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/processor/SignatureProcessor.java?rev=1673719&r1=1673718&r2=1673719&view=diff
==============================================================================
--- webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/processor/SignatureProcessor.java (original)
+++ webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/processor/SignatureProcessor.java Wed Apr 15 10:32:22 2015
@@ -418,7 +418,7 @@ public class SignatureProcessor implemen
             }
             
             // Test for replay attacks
-            testMessageReplay(elem, xmlSignature.getSignatureValue().getValue(), data, wsDocInfo);
+            testMessageReplay(elem, xmlSignature.getSignatureValue().getValue(), key, data, wsDocInfo);
             
             setElementsOnContext(xmlSignature, (DOMValidateContext)context, wsDocInfo, elem.getOwnerDocument());
             boolean signatureOk = xmlSignature.validate(context);
@@ -631,9 +631,11 @@ public class SignatureProcessor implemen
     }
     
     /**
-     * Test for a replayed message. The cache key is the Timestamp Created String and the signature value.
+     * Test for a replayed message. The cache key is the Timestamp Created String, the signature 
+     * value, and the encoded value of the signing key.
      * @param signatureElement
      * @param signatureValue
+     * @param key
      * @param requestData
      * @param wsDocInfo
      * @throws WSSecurityException
@@ -641,6 +643,7 @@ public class SignatureProcessor implemen
     private void testMessageReplay(
         Element signatureElement,
         byte[] signatureValue,
+        Key key,
         RequestData requestData,
         WSDocInfo wsDocInfo
     ) throws WSSecurityException {
@@ -674,7 +677,8 @@ public class SignatureProcessor implemen
         // Test for replay attacks
         Date created = timeStamp.getCreated();
         DateFormat zulu = new XmlSchemaDateFormat();
-        String identifier = zulu.format(created) + "" + Arrays.hashCode(signatureValue);
+        String identifier = zulu.format(created) + "" + Arrays.hashCode(signatureValue)
+            + "" + Arrays.hashCode(key.getEncoded());
 
         if (replayCache.contains(identifier)) {
             throw new WSSecurityException(
@@ -684,7 +688,7 @@ public class SignatureProcessor implemen
             );
         }
 
-        // Store the Timestamp/SignatureValue combination in the cache
+        // Store the Timestamp/SignatureValue/Key combination in the cache
         Date expires = timeStamp.getExpires();
         if (expires != null) {
             Date rightNow = new Date();