eclipse-ee4j / eclipse-ee4j/metro-wsit
Incorrect namespace prefixes included in PrefixList due to having colon in attribute value within SOAP Body
- Dominant language
- Java
- Stars
- 6
- Forks
- 21
- Avg merge
- 10h 2m
- Merged PRs (30d)
- 1
Description
When creating a SOAP request with the Body signed, for any attribute values within the SOAP Body that contain a ":", the text before the colon is interpreted incorrectly as an XML namespace prefix, and subsequently added to the InclusiveNamespaces PrefixList attribute.
Since there are no namespaces registered for these incorrectly identified prefixes, these values should not be included in the PrefixList.
The existence of these invalid prefixes breaks web service implementations using Apache WSS4J/XML Security (and possibly other WSS implementations), since it uses the PrefixList on the request to insert namespace attributes in the canonicalized SOAP Body element, and therefore the digest created differs from that of the Metro-based digest.
Metro-based canonicalized output (on which the request digest is generated):
```
```
Since Metro finds that the attentionLine attribute value begins with "attn:", it interprets the "attn" token as a prefix and adds it to the PrefixList in the SOAP request:
```
```
Once this request is sent to the web service, the Apache WSS4J implementation uses the PrefixList to insert namespace declarations into the canonicalized SOAP Body element:
```
```
Since the digest generated from this version of the SOAP Body element will differ from the digest on the request, verification fails.
#### Environment
JDK 1.7.0_71
Mac OS X 10.10.4
Metro 2.3.1
#### Affected Versions
[2.3]
Source: [https://github.com/javaee/metro-wsit/issues/1695](https://github.com/javaee/metro-wsit/issues/1695)
Author: glassfishrobot
Contributor guide
Research direction
Start by reproducing the SOAP signing example from the issue with Metro 2.3.1, especially the attentionLine value containing "attn:"; then trace the namespace-prefix collection used to build InclusiveNamespaces PrefixList. Done means unregistered tokens from attribute values are absent from PrefixList and the resulting digest verifies with Apache WSS4J/XML Security.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend-api-design, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100