ws-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Colm O hEigeartaigh (JIRA)" <j...@apache.org>
Subject [jira] [Closed] (WSS-636) CLONE - Password set to null in UsernameTokenValidator
Date Tue, 20 Nov 2018 16:48:00 GMT

     [ https://issues.apache.org/jira/browse/WSS-636?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Colm O hEigeartaigh closed WSS-636.
-----------------------------------
    Resolution: Duplicate

> CLONE - Password set to null in UsernameTokenValidator
> ------------------------------------------------------
>
>                 Key: WSS-636
>                 URL: https://issues.apache.org/jira/browse/WSS-636
>             Project: WSS4J
>          Issue Type: Bug
>          Components: WSS4J Core
>    Affects Versions: 2.2.2
>         Environment: linux, cxf, jetty 6.10
>            Reporter: Bouke
>            Assignee: Colm O hEigeartaigh
>            Priority: Major
>              Labels: UsernameTokenValidator
>
> When trying to do basic authentication in Soap header with UserNameToken, token is well
read from XML, but badly passed to password callback.
> Line 165 of org.apache.ws.security.validate.UsernameTokenValidator :
> WSPasswordCallback pwCb = 
>             new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN,
data);
> The password is set to null, while it has been correcty read just before.
> Proposed patch :
> Index: src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
> ===================================================================
> --- src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java	(révision
1098991)
> +++ src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java	(copie
de travail)
> @@ -163,7 +163,7 @@
>          boolean passwordsAreEncoded = usernameToken.getPasswordsAreEncoded();
>          
>          WSPasswordCallback pwCb = 
> -            new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN,
data);
> +            new WSPasswordCallback(user, password, pwType, WSPasswordCallback.USERNAME_TOKEN,
data);
>          try {
>              data.getCallbackHandler().handle(new Callback[]{pwCb});
>          } catch (IOException e) {



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org


Mime
View raw message