Skip to content
This repository has been archived by the owner on Jan 30, 2019. It is now read-only.

Incorrect namespace prefixes included in PrefixList due to having colon in attribute value within SOAP Body #1695

Open
glassfishrobot opened this issue Sep 23, 2015 · 3 comments

Comments

@glassfishrobot
Copy link
Contributor

When creating a SOAP request with the Body signed, for any attribute values within the SOAP Body that contain a ":", the text before the colon is interpreted incorrectly as an XML namespace prefix, and subsequently added to the InclusiveNamespaces PrefixList attribute.

Since there are no namespaces registered for these incorrectly identified prefixes, these values should not be included in the PrefixList.

The existence of these invalid prefixes breaks web service implementations using Apache WSS4J/XML Security (and possibly other WSS implementations), since it uses the PrefixList on the request to insert namespace attributes in the canonicalized SOAP Body element, and therefore the digest created differs from that of the Metro-based digest.

Example:

Metro-based canonicalized output (on which the request digest is generated):

<S:Body xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
  <AccountInfo xmlns="http://test.com/">
    <Address attentionLine="attn:Mr. Smith"/>
  </AccountInfo>
</S:Body>

Since Metro finds that the attentionLine attribute value begins with "attn:", it interprets the "attn" token as a prefix and adds it to the PrefixList in the SOAP request:

<exc14n:InclusiveNamespaces xmlns:exc14n="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="S attn"/>

Once this request is sent to the web service, the Apache WSS4J implementation uses the PrefixList to insert namespace declarations into the canonicalized SOAP Body element:

<S:Body xmlns:S="http://schemas.xmlsoap.org/soap/envelope/" xmlns:attn="">
  <AccountInfo xmlns="http://test.com/">
    <Address attentionLine="attn:Mr. Smith"/>
  </AccountInfo>
</S:Body>

Since the digest generated from this version of the SOAP Body element will differ from the digest on the request, verification fails.

Environment

JDK 1.7.0_71
Mac OS X 10.10.4
Metro 2.3.1

Affected Versions

[2.3]

@glassfishrobot
Copy link
Contributor Author

Reported by dallasvaughan

@glassfishrobot
Copy link
Contributor Author

Was assigned to symonchang

@glassfishrobot
Copy link
Contributor Author

This issue was imported from java.net JIRA WSIT-1695

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

1 participant