eclipse-ee4j / eclipse-ee4j/metro-wsit

Validating created and expires of timestamps fails when DST changes while application is running

Open
#137 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
6
Forks
21
Avg merge
10h 2m
Merged PRs (30d)
1

Description

## Problem / actual behavior
To verify the values of "created" and "expires" of a ws-security timestamp, the offset of the applications current timezone to UTC is calculated. Unfortunately, this happens in a static initialize block of the class [`DefaultSecurityEnvironmentImpl`](https://github.com/eclipse-ee4j/metro-wsit/blob/2.4.7/wsit/ws-sx/wssx-impl/src/main/java/com/sun/xml/wss/impl/misc/DefaultSecurityEnvironmentImpl.java#L92). If the daylight saving time changes while the application is running, which is a quite common use-case for a web-service, this previous computed offset is still used afterwards.

### Example
An example: the timezone is Europe/Berlin with DST on (means CEST aka GMT+2). The computed offset will be two hours. Let it be now 31/10/2021 at 3 am. The time changes to 2 am as DST got switched of and we are now back in "normal" time CET/GMT+1 with an offset of one hour. Incoming requests with a valid timestamp will be rejected from now on with error "The creation time is ahead of the current time.".

The adjusted current date uses the right local time (2 am) but the old offset of two hours is subtracted. A timestamp with a "created" value of 1 am UTC will then be treated as a future timestamp because `DefaultSecurityEnvironmentImpl` "thinks" the current time is midnight.

Similar when DST will be switched on but the error will then be "The creation time is older than currenttime - timestamp-freshness-limit - max-clock-skew".

## expected behavior
The offset must not be initialized statically! It should be computed on each invocation of [`DefaultSecurityEnvironmentImpl#defaultValidateCreationTime`](https://github.com/eclipse-ee4j/metro-wsit/blob/2.4.7/wsit/ws-sx/wssx-impl/src/main/java/com/sun/xml/wss/impl/misc/DefaultSecurityEnvironmentImpl.java#L1184). The affected methods `getFreshnessAndSkewAdjustedDate` and `getGMTDateWithSkewAdjusted` do already contain code to do so but it is commented out.

## Possible workarounds
- scheduled reboots after DST changes
- implement an own handler for a `TimestampValidationCallback`

Contributor guide

Open the contributing guide

Research direction

Start with wsit/ws-sx/wssx-impl/src/main/java/com/sun/xml/wss/impl/misc/DefaultSecurityEnvironmentImpl.java, especially defaultValidateCreationTime and the commented offset logic in getFreshnessAndSkewAdjustedDate and getGMTDateWithSkewAdjusted. Confirm how the static offset is used, then verify that timestamp validation recalculates the timezone offset after a DST change.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.