Skip to content

Commit f7934d2

Browse files
sgramponetomas-sexenian
sgrampone
and
tomas-sexenian
authored
Bump wss4j from version 1.6.19 to version 2.4.3 (#835)
* Bump wss4j from version 1.6.19 to version 2.4.3 * Bump wws4j from version 1.6.19 to version 2.4.3 * Issue: 107613 Exclude geronimo-javamail_1.4_mail from transitive dependencies * Exclude geronimo from wss4j-ws-security-dom * Add variable commons-io.version * Delete direct dependency commons-io --------- Co-authored-by: Tomás Sexenian <[email protected]>
1 parent 558a820 commit f7934d2

File tree

3 files changed

+74
-37
lines changed

3 files changed

+74
-37
lines changed

‎wrappercommon/pom.xml‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,28 @@
2929
<artifactId>log4j-core</artifactId>
3030
<version>${log4j.version}</version>
3131
</dependency>
32-
<dependency>
33-
<groupId>org.apache.ws.security</groupId>
34-
<artifactId>wss4j</artifactId>
35-
<version>1.6.19</version>
36-
</dependency>
32+
<dependency>
33+
<groupId>org.apache.wss4j</groupId>
34+
<artifactId>wss4j-ws-security-common</artifactId>
35+
<version>2.4.3</version>
36+
<exclusions>
37+
<exclusion>
38+
<groupId>org.apache.geronimo.javamail</groupId>
39+
<artifactId>geronimo-javamail_1.4_mail</artifactId>
40+
</exclusion>
41+
</exclusions>
42+
</dependency>
43+
<dependency>
44+
<groupId>org.apache.wss4j</groupId>
45+
<artifactId>wss4j-ws-security-dom</artifactId>
46+
<version>2.4.3</version>
47+
<exclusions>
48+
<exclusion>
49+
<groupId>org.apache.geronimo.javamail</groupId>
50+
<artifactId>geronimo-javamail_1.4_mail</artifactId>
51+
</exclusion>
52+
</exclusions>
53+
</dependency>
3754
<dependency>
3855
<groupId>org.apache.logging.log4j</groupId>
3956
<artifactId>log4j-layout-template-json</artifactId>

‎wrapperjakarta/src/main/java/com/genexus/ws/GXHandlerConsumerChain.java‎

Lines changed: 27 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
import java.util.Set;
44
import java.util.HashSet;
55
import java.util.Properties;
6+
import javax.crypto.KeyGenerator;
7+
import javax.crypto.SecretKey;
68
import javax.xml.namespace.QName;
79
import javax.xml.transform.*;
810
import javax.xml.transform.dom.DOMResult;
@@ -12,12 +14,14 @@
1214
import jakarta.xml.ws.handler.soap.SOAPMessageContext;
1315
import jakarta.xml.soap.*;
1416
import javax.xml.parsers.DocumentBuilderFactory;
15-
import org.apache.ws.security.components.crypto.Crypto;
16-
import org.apache.ws.security.components.crypto.CryptoFactory;
17-
import org.apache.ws.security.message.WSSecEncrypt;
18-
import org.apache.ws.security.message.WSSecHeader;
19-
import org.apache.ws.security.message.WSSecSignature;
20-
import org.apache.ws.security.message.WSSecTimestamp;
17+
18+
import org.apache.wss4j.common.crypto.Crypto;
19+
import org.apache.wss4j.common.crypto.CryptoFactory;
20+
import org.apache.wss4j.dom.message.WSSecEncrypt;
21+
import org.apache.wss4j.dom.message.WSSecHeader;
22+
import org.apache.wss4j.dom.message.WSSecSignature;
23+
import org.apache.wss4j.dom.message.WSSecTimestamp;
24+
2125
import org.w3c.dom.*;
2226
import java.io.InputStream;
2327
import java.io.ByteArrayInputStream;
@@ -26,6 +30,8 @@
2630
import com.genexus.diagnostics.core.LogManager;
2731
import com.genexus.common.interfaces.*;
2832

33+
import static org.apache.wss4j.common.util.KeyUtils.getKeyGenerator;
34+
2935
public class GXHandlerConsumerChain implements SOAPHandler<SOAPMessageContext>
3036
{
3137
public static final ILogger logger = LogManager.getLogger(GXHandlerConsumerChain.class);
@@ -156,8 +162,8 @@ public boolean handleMessage(SOAPMessageContext messageContext)
156162
Document doc = messageToDocument(messageContext.getMessage());
157163

158164
//Security header
159-
WSSecHeader secHeader = new WSSecHeader();
160-
secHeader.insertSecurityHeader(doc);
165+
WSSecHeader secHeader = new WSSecHeader(doc);
166+
secHeader.insertSecurityHeader();
161167
Document signedDoc = null;
162168

163169
//Signature
@@ -168,7 +174,7 @@ public boolean handleMessage(SOAPMessageContext messageContext)
168174
signatureProperties.put("org.apache.ws.security.crypto.merlin.keystore.password", wsSignature.getKeystore().getPassword());
169175
signatureProperties.put("org.apache.ws.security.crypto.merlin.file", wsSignature.getKeystore().getSource());
170176
Crypto signatureCrypto = CryptoFactory.getInstance(signatureProperties);
171-
WSSecSignature sign = new WSSecSignature();
177+
WSSecSignature sign = new WSSecSignature(doc);
172178
sign.setKeyIdentifierType(wsSignature.getKeyIdentifierType());
173179
sign.setUserInfo(wsSignature.getAlias(), wsSignature.getKeystore().getPassword());
174180
if (wsSignature.getCanonicalizationalgorithm() != null)
@@ -177,13 +183,13 @@ public boolean handleMessage(SOAPMessageContext messageContext)
177183
sign.setDigestAlgo(wsSignature.getDigest());
178184
if (wsSignature.getSignaturealgorithm() != null)
179185
sign.setSignatureAlgorithm(wsSignature.getSignaturealgorithm());
180-
signedDoc = sign.build(doc, signatureCrypto, secHeader);
186+
signedDoc = sign.build( signatureCrypto);
181187

182188
if (expirationTimeout > 0)
183189
{
184-
WSSecTimestamp timestamp = new WSSecTimestamp();
190+
WSSecTimestamp timestamp = new WSSecTimestamp(secHeader);
185191
timestamp.setTimeToLive(expirationTimeout);
186-
signedDoc = timestamp.build(signedDoc, secHeader);
192+
signedDoc = timestamp.build();
187193
}
188194
}
189195

@@ -195,14 +201,19 @@ public boolean handleMessage(SOAPMessageContext messageContext)
195201
encryptionProperties.put("org.apache.ws.security.crypto.merlin.keystore.password", wsEncryption.getKeystore().getPassword());
196202
encryptionProperties.put("org.apache.ws.security.crypto.merlin.file", wsEncryption.getKeystore().getSource());
197203
Crypto encryptionCrypto = CryptoFactory.getInstance(encryptionProperties);
198-
WSSecEncrypt builder = new WSSecEncrypt();
199-
builder.setUserInfo(wsEncryption.getAlias(), wsEncryption.getKeystore().getPassword());
200-
builder.setKeyIdentifierType(wsEncryption.getKeyIdentifierType());
201204
if (signedDoc == null)
202205
{
203206
signedDoc = doc;
204207
}
205-
builder.build(signedDoc, encryptionCrypto, secHeader);
208+
WSSecEncrypt builder = new WSSecEncrypt(signedDoc);
209+
builder.setUserInfo(wsEncryption.getAlias(), wsEncryption.getKeystore().getPassword());
210+
builder.setKeyIdentifierType(wsEncryption.getKeyIdentifierType());
211+
//using wss4j default encryption algorithm AES128-CBC
212+
KeyGenerator keyGenerator = KeyGenerator.getInstance("AES");
213+
keyGenerator.init(128);
214+
SecretKey key = keyGenerator.generateKey();
215+
216+
builder.build(encryptionCrypto, key);
206217
}
207218

208219
Document securityDoc = doc;

‎wrapperjavax/src/main/java/com/genexus/ws/GXHandlerConsumerChain.java‎

Lines changed: 25 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
import java.util.Set;
44
import java.util.HashSet;
55
import java.util.Properties;
6+
import javax.crypto.KeyGenerator;
7+
import javax.crypto.SecretKey;
68
import javax.xml.namespace.QName;
79
import javax.xml.transform.*;
810
import javax.xml.transform.dom.DOMResult;
@@ -12,12 +14,14 @@
1214
import javax.xml.ws.handler.soap.SOAPMessageContext;
1315
import javax.xml.soap.*;
1416
import javax.xml.parsers.DocumentBuilderFactory;
15-
import org.apache.ws.security.components.crypto.Crypto;
16-
import org.apache.ws.security.components.crypto.CryptoFactory;
17-
import org.apache.ws.security.message.WSSecEncrypt;
18-
import org.apache.ws.security.message.WSSecHeader;
19-
import org.apache.ws.security.message.WSSecSignature;
20-
import org.apache.ws.security.message.WSSecTimestamp;
17+
18+
import org.apache.wss4j.common.crypto.Crypto;
19+
import org.apache.wss4j.common.crypto.CryptoFactory;
20+
import org.apache.wss4j.dom.message.WSSecEncrypt;
21+
import org.apache.wss4j.dom.message.WSSecHeader;
22+
import org.apache.wss4j.dom.message.WSSecSignature;
23+
import org.apache.wss4j.dom.message.WSSecTimestamp;
24+
2125
import org.w3c.dom.*;
2226
import java.io.InputStream;
2327
import java.io.ByteArrayInputStream;
@@ -156,8 +160,8 @@ public boolean handleMessage(SOAPMessageContext messageContext)
156160
Document doc = messageToDocument(messageContext.getMessage());
157161

158162
//Security header
159-
WSSecHeader secHeader = new WSSecHeader();
160-
secHeader.insertSecurityHeader(doc);
163+
WSSecHeader secHeader = new WSSecHeader(doc);
164+
secHeader.insertSecurityHeader();
161165
Document signedDoc = null;
162166

163167
//Signature
@@ -168,7 +172,7 @@ public boolean handleMessage(SOAPMessageContext messageContext)
168172
signatureProperties.put("org.apache.ws.security.crypto.merlin.keystore.password", wsSignature.getKeystore().getPassword());
169173
signatureProperties.put("org.apache.ws.security.crypto.merlin.file", wsSignature.getKeystore().getSource());
170174
Crypto signatureCrypto = CryptoFactory.getInstance(signatureProperties);
171-
WSSecSignature sign = new WSSecSignature();
175+
WSSecSignature sign = new WSSecSignature(doc);
172176
sign.setKeyIdentifierType(wsSignature.getKeyIdentifierType());
173177
sign.setUserInfo(wsSignature.getAlias(), wsSignature.getKeystore().getPassword());
174178
if (wsSignature.getCanonicalizationalgorithm() != null)
@@ -177,13 +181,13 @@ public boolean handleMessage(SOAPMessageContext messageContext)
177181
sign.setDigestAlgo(wsSignature.getDigest());
178182
if (wsSignature.getSignaturealgorithm() != null)
179183
sign.setSignatureAlgorithm(wsSignature.getSignaturealgorithm());
180-
signedDoc = sign.build(doc, signatureCrypto, secHeader);
184+
signedDoc = sign.build( signatureCrypto);
181185

182186
if (expirationTimeout > 0)
183187
{
184-
WSSecTimestamp timestamp = new WSSecTimestamp();
188+
WSSecTimestamp timestamp = new WSSecTimestamp(secHeader);
185189
timestamp.setTimeToLive(expirationTimeout);
186-
signedDoc = timestamp.build(signedDoc, secHeader);
190+
signedDoc = timestamp.build();
187191
}
188192
}
189193

@@ -195,14 +199,19 @@ public boolean handleMessage(SOAPMessageContext messageContext)
195199
encryptionProperties.put("org.apache.ws.security.crypto.merlin.keystore.password", wsEncryption.getKeystore().getPassword());
196200
encryptionProperties.put("org.apache.ws.security.crypto.merlin.file", wsEncryption.getKeystore().getSource());
197201
Crypto encryptionCrypto = CryptoFactory.getInstance(encryptionProperties);
198-
WSSecEncrypt builder = new WSSecEncrypt();
199-
builder.setUserInfo(wsEncryption.getAlias(), wsEncryption.getKeystore().getPassword());
200-
builder.setKeyIdentifierType(wsEncryption.getKeyIdentifierType());
201202
if (signedDoc == null)
202203
{
203204
signedDoc = doc;
204205
}
205-
builder.build(signedDoc, encryptionCrypto, secHeader);
206+
WSSecEncrypt builder = new WSSecEncrypt(signedDoc);
207+
builder.setUserInfo(wsEncryption.getAlias(), wsEncryption.getKeystore().getPassword());
208+
builder.setKeyIdentifierType(wsEncryption.getKeyIdentifierType());
209+
//using wss4j default encryption algorithm AES128-CBC
210+
KeyGenerator keyGenerator = KeyGenerator.getInstance("AES");
211+
keyGenerator.init(128);
212+
SecretKey key = keyGenerator.generateKey();
213+
214+
builder.build(encryptionCrypto, key);
206215
}
207216

208217
Document securityDoc = doc;

0 commit comments

Comments
 (0)