Skip to content

Commit 2f275a5

Browse files
author
Tareq Abedrabbo
committed
SWS-577 - Wss4jSecurityInterceptor ignores Timestamp timeToLive property when creating Timestamp element
1 parent 6b33487 commit 2f275a5

File tree

4 files changed

+75
-29
lines changed

4 files changed

+75
-29
lines changed

‎security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,9 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
121121

122122
private boolean enableSignatureConfirmation;
123123

124-
private int timeToLive = 300;
124+
private int validationTimeToLive = 300;
125+
126+
private int securementTimeToLive = 300;
125127

126128
private final Wss4jHandler handler = new Wss4jHandler();
127129

@@ -346,12 +348,27 @@ public void setSecurementUsername(String securementUsername) {
346348
this.securementUsername = securementUsername;
347349
}
348350

351+
/** Sets the time to live on the outgoing message */
352+
public void setSecurementTimeToLive(int securementTimeToLive) {
353+
if (securementTimeToLive <= 0) {
354+
throw new IllegalArgumentException("timeToLive must be positive");
355+
}
356+
this.securementTimeToLive = securementTimeToLive;
357+
}
358+
349359
/** Sets the server-side time to live */
350-
public void setTimeToLive(int timeToLive) {
351-
if (timeToLive <= 0) {
360+
public void setValidationTimeToLive(int validationTimeToLive) {
361+
if (validationTimeToLive <= 0) {
352362
throw new IllegalArgumentException("timeToLive must be positive");
353363
}
354-
this.timeToLive = timeToLive;
364+
this.validationTimeToLive = validationTimeToLive;
365+
}
366+
367+
/** Sets the server-side time to live
368+
* @deprecated Use {@link #setValidationTimeToLive(int)} instead.
369+
* */
370+
public void setTimeToLive(int timeToLive) {
371+
setValidationTimeToLive(timeToLive);
355372
}
356373

357374
/** Sets the validation actions to be executed by the interceptor. */
@@ -497,6 +514,9 @@ private RequestData initializeRequestData(MessageContext messageContext) {
497514
else {
498515
requestData.setUsername(securementUsername);
499516
}
517+
518+
requestData.setTimeToLive(securementTimeToLive);
519+
500520
return requestData;
501521
}
502522

@@ -596,12 +616,11 @@ protected void verifyTimestamp(Vector results) throws WSSecurityException {
596616
if (actionResult != null) {
597617
Timestamp timestamp = (Timestamp) actionResult.get(WSSecurityEngineResult.TAG_TIMESTAMP);
598618
if (timestamp != null && timestampStrict) {
599-
if (!handler.verifyTimestamp(timestamp, timeToLive)) {
619+
if (!handler.verifyTimestamp(timestamp, validationTimeToLive)) {
600620
throw new Wss4jSecurityValidationException("Invalid timestamp : " + timestamp.getID());
601621
}
602622
}
603623
}
604-
605624
}
606625

607626
private void processPrincipal(Vector results) {

‎security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorTimestampTestCase.java‎

Lines changed: 36 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,21 @@
1717
package org.springframework.ws.soap.security.wss4j;
1818

1919
import java.lang.reflect.Field;
20+
import java.text.DateFormat;
21+
import java.text.SimpleDateFormat;
22+
23+
import javax.xml.transform.TransformerFactory;
24+
import javax.xml.transform.Transformer;
25+
import javax.xml.transform.Result;
26+
import javax.xml.transform.Source;
2027

2128
import org.w3c.dom.Document;
2229

2330
import org.springframework.ws.context.DefaultMessageContext;
2431
import org.springframework.ws.context.MessageContext;
2532
import org.springframework.ws.soap.SoapMessage;
33+
import org.springframework.ws.soap.security.WsSecurityValidationException;
34+
import org.springframework.xml.transform.StringResult;
2635

2736
public abstract class Wss4jMessageInterceptorTimestampTestCase extends Wss4jTestCase {
2837

@@ -50,36 +59,41 @@ public void testValidateTimestamp() throws Exception {
5059
getDocument(message));
5160
}
5261

53-
public void testValidateTimestampWithTtl() throws Exception {
54-
Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor() {
55-
public void setTimeToLive(int t) {
56-
try {
57-
Field ttl = Wss4jSecurityInterceptor.class
58-
.getDeclaredField("timeToLive");
59-
ttl.setAccessible(true);
60-
ttl.set(this, new Integer(t));
61-
62-
}
63-
catch (Exception e) {
64-
throw new RuntimeException(e);
65-
}
66-
}
67-
};
62+
public void testValidateTimestampWithExpiredTtl() throws Exception {
63+
Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
6864
interceptor.setValidationActions("Timestamp");
69-
interceptor.setTimeToLive(-10);
70-
interceptor.setTimestampStrict(true);
7165
interceptor.afterPropertiesSet();
72-
SoapMessage message = getMessageWithTimestamp();
66+
SoapMessage message = loadMessage("expiredTimestamp-soap.xml");
7367
MessageContext context = new DefaultMessageContext(message, getMessageFactory());
74-
7568
try {
7669
interceptor.validateMessage(message, context);
70+
fail();
7771
}
78-
catch (Wss4jSecurityValidationException ex) {
72+
catch (WsSecurityValidationException e) {
7973
// expected
80-
return;
8174
}
82-
fail("Time to live validation failed");
75+
}
76+
77+
public void testSecureTimestampWithCustomTtl() throws Exception {
78+
int ttlInSeconds = 1;
79+
Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
80+
interceptor.setSecurementActions("Timestamp");
81+
interceptor.setTimestampStrict(true);
82+
interceptor.setSecurementTimeToLive(ttlInSeconds);
83+
interceptor.afterPropertiesSet();
84+
SoapMessage message = loadMessage("empty-soap.xml");
85+
MessageContext context = new DefaultMessageContext(message, getMessageFactory());
86+
interceptor.secureMessage(message, context);
87+
88+
String created = xpathTemplate.evaluateAsString("/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsu:Timestamp/wsu:Created/text()",
89+
message.getEnvelope().getSource());
90+
String expires = xpathTemplate.evaluateAsString("/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsu:Timestamp/wsu:Expires/text()",
91+
message.getEnvelope().getSource());
92+
93+
DateFormat format = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SS'Z'");
94+
95+
long actualTtl = format.parse(expires).getTime() - format.parse(created).getTime();
96+
assertEquals("invalid ttl", 1000 * ttlInSeconds, actualTtl);
8397
}
8498

8599
private SoapMessage getMessageWithTimestamp() throws Exception {

‎security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jTestCase.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,6 @@ protected final void setUp() throws Exception {
6565
"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");
6666
namespaces.setProperty("ds", "http://www.w3.org/2000/09/xmldsig#");
6767
namespaces.setProperty("xenc", "http://www.w3.org/2001/04/xmlenc#");
68-
// namespaces.put("wsse11", "http://docs.oasis-open.org/wss/2005/xx/oasis-2005xx-wss-wssecurity-secext-1.1.xsd");
6968
namespaces.setProperty("wsse11", "http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd");
7069
namespaces.setProperty("echo", "http://www.springframework.org/spring-ws/samples/echo");
7170
namespaces.setProperty("wsu",

‎security/src/test/resources/org/springframework/ws/soap/security/wss4j/expiredTimestamp-soap.xml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
3+
<SOAP-ENV:Header>
4+
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" SOAP-ENV:mustUnderstand="1">
5+
<wsu:Timestamp xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Timestamp-27">
6+
<wsu:Created>2009-12-25T15:43:22.687Z</wsu:Created>
7+
<wsu:Expires>2009-12-25T15:48:22.687Z</wsu:Expires>
8+
</wsu:Timestamp>
9+
</wsse:Security>
10+
</SOAP-ENV:Header>
11+
<SOAP-ENV:Body>
12+
<tru:StockSymbol xmlns:tru="http://fabrikam123.com/payloads">QQQ</tru:StockSymbol>
13+
</SOAP-ENV:Body>
14+
</SOAP-ENV:Envelope>

0 commit comments

Comments
 (0)