You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2019/10/31 15:00:05 UTC
[cxf] branch 3.2.x-fixes updated (d63206e -> 5ad03bb)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a change to branch 3.2.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git.
from d63206e Recording .gitmergeinfo Changes
new 2b40c85 CXF-8139 - SecurityToken, parsing the lifetime may cause a NullPointerException
new 5ad03bb Recording .gitmergeinfo Changes
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.gitmergeinfo | 1 +
.../cxf/ws/security/tokenstore/SecurityToken.java | 11 +-
.../ws/security/tokenstore/SecurityTokenTest.java | 130 +++++++++++++++++++++
3 files changed, 140 insertions(+), 2 deletions(-)
create mode 100644 rt/ws/security/src/test/java/org/apache/cxf/ws/security/tokenstore/SecurityTokenTest.java
[cxf] 02/02: Recording .gitmergeinfo Changes
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.2.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 5ad03bb4992a21b25717c87077ea318845f00041
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Thu Oct 31 14:59:49 2019 +0000
Recording .gitmergeinfo Changes
---
.gitmergeinfo | 1 +
1 file changed, 1 insertion(+)
diff --git a/.gitmergeinfo b/.gitmergeinfo
index 96a48e2..f7f2816 100644
--- a/.gitmergeinfo
+++ b/.gitmergeinfo
@@ -374,6 +374,7 @@ B 873f7aae9d6d239320b1aa419916bb4292ec346b
B 8766a7535603bfc0b2d1f8b9b70150d2471c5c2a
B 87865b1aec7e5524e5aa5b2e4ad2d2e2704f27b2
B 87d6a2773e43b73d837e3894ee56f8f9cebfb98a
+B 883cc278b316ca54b4ff158669b2a5ca9ec2af6f
B 886baa398cb24fe4e6f052e0ab809a8b6e2ac40a
B 88b4bab7c7570e3f90f7883581ae224c8321a9a2
B 8938ee23c916dbd12eed7091b13bd102cca9d2b9
[cxf] 01/02: CXF-8139 - SecurityToken,
parsing the lifetime may cause a NullPointerException
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.2.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 2b40c85c581d24a284f12738b986bddc66a42c3a
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Thu Oct 31 13:52:57 2019 +0000
CXF-8139 - SecurityToken, parsing the lifetime may cause a NullPointerException
(cherry picked from commit 189b12e8ca5131f409e6fe68e6665cc9bc02b3d1)
(cherry picked from commit d7179ea5fa8365e939338634a5b30a39bda8161c)
---
.../cxf/ws/security/tokenstore/SecurityToken.java | 11 +-
.../ws/security/tokenstore/SecurityTokenTest.java | 130 +++++++++++++++++++++
2 files changed, 139 insertions(+), 2 deletions(-)
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/tokenstore/SecurityToken.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/tokenstore/SecurityToken.java
index 0da6d98..157cab0 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/tokenstore/SecurityToken.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/tokenstore/SecurityToken.java
@@ -230,13 +230,20 @@ public class SecurityToken implements Serializable {
DOMUtils.getFirstChildWithName(lifetimeElem,
WSS4JConstants.WSU_NS,
WSS4JConstants.CREATED_LN);
- this.created = ZonedDateTime.parse(DOMUtils.getContent(createdElem)).toInstant();
+ if (createdElem == null) {
+ // The spec says that if there is no Created Element in the Lifetime, then take the current time
+ this.created = Instant.now();
+ } else {
+ this.created = ZonedDateTime.parse(DOMUtils.getContent(createdElem)).toInstant();
+ }
Element expiresElem =
DOMUtils.getFirstChildWithName(lifetimeElem,
WSS4JConstants.WSU_NS,
WSS4JConstants.EXPIRES_LN);
- this.expires = ZonedDateTime.parse(DOMUtils.getContent(expiresElem)).toInstant();
+ if (expiresElem != null) {
+ this.expires = ZonedDateTime.parse(DOMUtils.getContent(expiresElem)).toInstant();
+ }
} catch (DateTimeParseException e) {
//shouldn't happen
}
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/tokenstore/SecurityTokenTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/tokenstore/SecurityTokenTest.java
new file mode 100644
index 0000000..d8b2dea
--- /dev/null
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/tokenstore/SecurityTokenTest.java
@@ -0,0 +1,130 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.ws.security.tokenstore;
+
+import java.time.Instant;
+import java.time.ZoneOffset;
+
+import org.w3c.dom.Element;
+
+import org.apache.cxf.helpers.DOMUtils;
+import org.apache.cxf.staxutils.W3CDOMStreamWriter;
+import org.apache.cxf.ws.security.trust.STSUtils;
+import org.apache.wss4j.common.WSS4JConstants;
+import org.apache.wss4j.common.util.DateUtil;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+
+public class SecurityTokenTest {
+
+ @org.junit.Test
+ public void testCreateSecurityToken() throws Exception {
+ String key = "key";
+ Instant created = Instant.now();
+ Instant expires = created.plusSeconds(20L);
+
+ SecurityToken token = new SecurityToken(key, created, expires);
+ assertEquals(key, token.getId());
+ assertEquals(created, token.getCreated());
+ assertEquals(expires, token.getExpires());
+ }
+
+ @org.junit.Test
+ public void testParseLifetimeElement() throws Exception {
+ String key = "key";
+ Element tokenElement = DOMUtils.createDocument().createElement("token");
+
+ // Create Lifetime
+ W3CDOMStreamWriter writer = new W3CDOMStreamWriter();
+ Instant created = Instant.now();
+ Instant expires = created.plusSeconds(20L);
+
+ String namespace = STSUtils.WST_NS_05_12;
+ writer.writeStartElement("wst", "Lifetime", namespace);
+ writer.writeNamespace("wst", namespace);
+ writer.writeNamespace("wsu", WSS4JConstants.WSU_NS);
+ writer.writeStartElement("wsu", "Created", WSS4JConstants.WSU_NS);
+ writer.writeCharacters(created.atZone(ZoneOffset.UTC).format(DateUtil.getDateTimeFormatter(true)));
+ writer.writeEndElement();
+
+ writer.writeStartElement("wsu", "Expires", WSS4JConstants.WSU_NS);
+ writer.writeCharacters(expires.atZone(ZoneOffset.UTC).format(DateUtil.getDateTimeFormatter(true)));
+ writer.writeEndElement();
+ writer.writeEndElement();
+
+ SecurityToken token = new SecurityToken(key, tokenElement, writer.getDocument().getDocumentElement());
+ assertEquals(key, token.getId());
+ assertEquals(created, token.getCreated());
+ assertEquals(expires, token.getExpires());
+ }
+
+ @org.junit.Test
+ public void testLifetimeNoCreated() throws Exception {
+ String key = "key";
+ Element tokenElement = DOMUtils.createDocument().createElement("token");
+
+ // Create Lifetime
+ W3CDOMStreamWriter writer = new W3CDOMStreamWriter();
+ Instant created = Instant.now();
+ Instant expires = created.plusSeconds(20L);
+
+ String namespace = STSUtils.WST_NS_05_12;
+ writer.writeStartElement("wst", "Lifetime", namespace);
+ writer.writeNamespace("wst", namespace);
+ writer.writeNamespace("wsu", WSS4JConstants.WSU_NS);
+
+ writer.writeStartElement("wsu", "Expires", WSS4JConstants.WSU_NS);
+ writer.writeCharacters(expires.atZone(ZoneOffset.UTC).format(DateUtil.getDateTimeFormatter(true)));
+ writer.writeEndElement();
+ writer.writeEndElement();
+
+ SecurityToken token = new SecurityToken(key, tokenElement, writer.getDocument().getDocumentElement());
+ assertEquals(key, token.getId());
+ // It should default to the current time
+ assertNotNull(token.getCreated());
+ assertEquals(expires, token.getExpires());
+ }
+
+ @org.junit.Test
+ public void testLifetimeNoExpires() throws Exception {
+ String key = "key";
+ Element tokenElement = DOMUtils.createDocument().createElement("token");
+
+ // Create Lifetime
+ W3CDOMStreamWriter writer = new W3CDOMStreamWriter();
+ Instant created = Instant.now();
+
+ String namespace = STSUtils.WST_NS_05_12;
+ writer.writeStartElement("wst", "Lifetime", namespace);
+ writer.writeNamespace("wst", namespace);
+ writer.writeNamespace("wsu", WSS4JConstants.WSU_NS);
+ writer.writeStartElement("wsu", "Created", WSS4JConstants.WSU_NS);
+ writer.writeCharacters(created.atZone(ZoneOffset.UTC).format(DateUtil.getDateTimeFormatter(true)));
+ writer.writeEndElement();
+
+ writer.writeEndElement();
+
+ SecurityToken token = new SecurityToken(key, tokenElement, writer.getDocument().getDocumentElement());
+ assertEquals(key, token.getId());
+ assertEquals(created, token.getCreated());
+ assertNull(token.getExpires());
+ }
+}