You are viewing a plain text version of this content. The canonical link for it is here.
Posted to wss4j-dev@ws.apache.org by Gürkan Vural <gu...@tcmb.gov.tr> on 2007/01/15 10:43:10 UTC
WSHandler checkReceiverResults
Are there any reason to comment out the below code im WSHandler
checkReceiverResults function?
// if (size != resultActions) {
// throw new AxisFault(
// "WSDoAllReceiver: security processing failed (actions number
// mismatch)");
// }
--
gürkan
==========================================================-
Bu e-posta sadece yukarida isimleri belirtilen kisiler arasinda �zel haberlesme amacini tasimaktadir. Size yanlislikla ulasmissa l�tfen g�nderen kisiyi bilgilendiriniz ve mesaji sisteminizden siliniz. Turkiye Cumhuriyet Merkez Bankasi A.S. bu mesajin icerigi ile ilgili olarak hicbir hukuksal sorumlulugu kabul etmez.
This e-mail communication is intended for the private use of the people named above. If you received this message in error, please immediately notify the sender and delete it from your system. The Central Bank of The Republic of Turkey does not accept legal responsibility for the contents of this message.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
Re: WSHandler checkReceiverResults
Posted by Davanum Srinivas <da...@gmail.com>.
Gurkan,
Please create an issue in JIRA so that we can track/fix the problem
thanks,
dims
On 1/16/07, Gürkan Vural <gu...@tcmb.gov.tr> wrote:
> In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
> which also checks the size of actions. However this part is moved in
> WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
> action size check is commented out. However the checking for loop is
> controled against the size of actions received in the SOAP message. This
> cause a security problem when an empty security header is sent. It omits
> the for loop and throws no exception!
>
> On Pzt, 2007-01-15 at 11:43 +0200, Gürkan Vural wrote:
> > Are there any reason to comment out the below code im WSHandler
> > checkReceiverResults function?
> >
> > // if (size != resultActions) {
> > // throw new AxisFault(
> > // "WSDoAllReceiver: security processing failed (actions number
> > // mismatch)");
> > // }
> >
>
> --
> gürkan
>
>
> ==========================================================-
> Bu e-posta sadece yukarida isimleri belirtilen kisiler arasinda �zel haberlesme amacini tasimaktadir. Size yanlislikla ulasmissa l�tfen g�nderen kisiyi bilgilendiriniz ve mesaji sisteminizden siliniz. Turkiye Cumhuriyet Merkez Bankasi A.S. bu mesajin icerigi ile ilgili olarak hicbir hukuksal sorumlulugu kabul etmez.
>
> This e-mail communication is intended for the private use of the people named above. If you received this message in error, please immediately notify the sender and delete it from your system. The Central Bank of The Republic of Turkey does not accept legal responsibility for the contents of this message.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
> For additional commands, e-mail: wss4j-dev-help@ws.apache.org
>
>
--
Davanum Srinivas : http://www.wso2.net (Oxygen for Web Service Developers)
Re: WSHandler checkReceiverResults
Posted by Davanum Srinivas <da...@gmail.com>.
Gurkan,
Please create an issue in JIRA so that we can track/fix the problem
thanks,
dims
On 1/16/07, Gürkan Vural <gu...@tcmb.gov.tr> wrote:
> In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
> which also checks the size of actions. However this part is moved in
> WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
> action size check is commented out. However the checking for loop is
> controled against the size of actions received in the SOAP message. This
> cause a security problem when an empty security header is sent. It omits
> the for loop and throws no exception!
>
> On Pzt, 2007-01-15 at 11:43 +0200, Gürkan Vural wrote:
> > Are there any reason to comment out the below code im WSHandler
> > checkReceiverResults function?
> >
> > // if (size != resultActions) {
> > // throw new AxisFault(
> > // "WSDoAllReceiver: security processing failed (actions number
> > // mismatch)");
> > // }
> >
>
> --
> gürkan
>
>
> ==========================================================-
> Bu e-posta sadece yukarida isimleri belirtilen kisiler arasinda �zel haberlesme amacini tasimaktadir. Size yanlislikla ulasmissa l�tfen g�nderen kisiyi bilgilendiriniz ve mesaji sisteminizden siliniz. Turkiye Cumhuriyet Merkez Bankasi A.S. bu mesajin icerigi ile ilgili olarak hicbir hukuksal sorumlulugu kabul etmez.
>
> This e-mail communication is intended for the private use of the people named above. If you received this message in error, please immediately notify the sender and delete it from your system. The Central Bank of The Republic of Turkey does not accept legal responsibility for the contents of this message.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
> For additional commands, e-mail: wss4j-dev-help@ws.apache.org
>
>
--
Davanum Srinivas : http://www.wso2.net (Oxygen for Web Service Developers)
Re: WSHandler checkReceiverResults
Posted by Gürkan Vural <gu...@tcmb.gov.tr>.
In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
which also checks the size of actions. However this part is moved in
WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
action size check is commented out. However the checking for loop is
controled against the size of actions received in the SOAP message. This
cause a security problem when an empty security header is sent. It omits
the for loop and throws no exception!
On Pzt, 2007-01-15 at 11:43 +0200, Gürkan Vural wrote:
> Are there any reason to comment out the below code im WSHandler
> checkReceiverResults function?
>
> // if (size != resultActions) {
> // throw new AxisFault(
> // "WSDoAllReceiver: security processing failed (actions number
> // mismatch)");
> // }
>
--
gürkan
==========================================================-
Bu e-posta sadece yukarida isimleri belirtilen kisiler arasinda �zel haberlesme amacini tasimaktadir. Size yanlislikla ulasmissa l�tfen g�nderen kisiyi bilgilendiriniz ve mesaji sisteminizden siliniz. Turkiye Cumhuriyet Merkez Bankasi A.S. bu mesajin icerigi ile ilgili olarak hicbir hukuksal sorumlulugu kabul etmez.
This e-mail communication is intended for the private use of the people named above. If you received this message in error, please immediately notify the sender and delete it from your system. The Central Bank of The Republic of Turkey does not accept legal responsibility for the contents of this message.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
Re: WSHandler checkReceiverResults
Posted by Gürkan Vural <gu...@tcmb.gov.tr>.
In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
which also checks the size of actions. However this part is moved in
WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
action size check is commented out. However the checking for loop is
controled against the size of actions received in the SOAP message. This
cause a security problem when an empty security header is sent. It omits
the for loop and throws no exception!
On Pzt, 2007-01-15 at 11:43 +0200, Gürkan Vural wrote:
> Are there any reason to comment out the below code im WSHandler
> checkReceiverResults function?
>
> // if (size != resultActions) {
> // throw new AxisFault(
> // "WSDoAllReceiver: security processing failed (actions number
> // mismatch)");
> // }
>
--
gürkan
==========================================================-
Bu e-posta sadece yukarida isimleri belirtilen kisiler arasinda �zel haberlesme amacini tasimaktadir. Size yanlislikla ulasmissa l�tfen g�nderen kisiyi bilgilendiriniz ve mesaji sisteminizden siliniz. Turkiye Cumhuriyet Merkez Bankasi A.S. bu mesajin icerigi ile ilgili olarak hicbir hukuksal sorumlulugu kabul etmez.
This e-mail communication is intended for the private use of the people named above. If you received this message in error, please immediately notify the sender and delete it from your system. The Central Bank of The Republic of Turkey does not accept legal responsibility for the contents of this message.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org