Element owner document is inconsistent within SOAP document

[brodziakm]

In a nutshell:

• In SAAJ 1.3.x, document elements would all return the same SOAPDocumentImpl instance
• Since SAAJ 1.4, some document elements (the URI attribute, for example) return com.sun.org.apache.xerces.internal.dom.DocumentImpl, which is the DomDocument within the SOAPDocument

Because some elements exist in different document instances this results in some problems. Most notably, when testing under Java 11:

• dsig can correctly canonicalize and sign a document with SAAJ 1.3. With SAAJ 1.4 and later the canonicalization results in an incorrect digest and signature, causing document validation to fail
• Apache Santuario can correctly canonicalize and sign a document with SAAJ 1.3. With SAAJ 1.4 and later the library can fail during canonicalization

This is largely described under this issue, but the issue most specifically lies within SAAJ (thanks @shunkica): https://github.com/eclipse-ee4j/metro-jax-ws/issues/93

Some people have tried various workarounds to bypass the issue, but these workarounds are highly situational and can't always be applied.

An issue was raised with Apache Santuario (see https://issues.apache.org/jira/browse/SANTUARIO-516) but this issue was closed because they identified that there is an underlying issue within SAAJ. The Santuario team (thanks @coheigea) kindly provided a test case to illustrate. This test case is linked in the above, but is at https://github.com/coheigea/testcases/tree/master/misc/saaj

[brodziakm]

I've prepared a candidate fix. I'd be happy to raise a pull request to have this integrated, but it isn't immediately clear which branch to target this at for a 1.5.3 patch, assuming that is possible. Please advise and I'll adjust accordingly.

[lukasj]

There's no branch for 1.5 yet. The best would be to target master and include it in 1.5.x once we get there - when Jakarta EE 9 related work is done

[brodziakm]

I have prepared a fix that allows us to correctly sign using both dsig and Apache Santuario. The fix is currently in my fork, on branch is165.2 (work was based on the current 1.5.2 release).

I tried applying this change to the tip of master to support a pull request and I am having difficulty in building. There appears to have been a move from javax.xml.soap to jakarta.xml.soap., and I am not able to resolve the Jakarta artifacts at build time. From what I can tell the 2.0.0 release of this API is not yet available (should the dependency version be against 2.0.0-RC3)?

Please let me know how to proceed.

[lukasj]

run the build with -Pstaging, that will help

[brodziakm]

Great, that seems to have done the trick. Thanks for that.

I'll aim to get the PR up tomorrow, I'm out of time today.

[lukasj]

Great. This can be something I could do respin of final 2.0.0 build for...

[brodziakm]

166 has been raised to address this.

[lukasj]

fixed in 2.0.0