Holodeck B2B is an AS4 system-to-system messaging solution that implements the OASIS specifications for ebMS3 and it's AS4 profile. For more information visit the project website
When trying to send messages which require signing both SOAP header data and SOAP body data. Bug was encountered resulting in all of generated IDs, (including signature references, encryption data references, encryption keys references, ...) inside WSS header to consist of prefix only without uniquely generated number following it.
For instance both header and body are assigned same id: id-. Same happens for other references SIG-, ED-, EK- ,... This leads to failed decryption of WSS header, and thus entire message, on recipients side.
Bug was traced to lines 451 & 455 respectively in source code of SecurityHeaderCreator. There is a subtle bug due to operator precedence between ternary operator and addition operator, leading to improper string concatenation.
When trying to send messages which require signing both SOAP header data and SOAP body data. Bug was encountered resulting in all of generated IDs, (including signature references, encryption data references, encryption keys references, ...) inside WSS header to consist of prefix only without uniquely generated number following it.
For instance both header and body are assigned same id:
id-
. Same happens for other referencesSIG-
,ED-
,EK-
,... This leads to failed decryption of WSS header, and thus entire message, on recipients side.Bug was traced to lines 451 & 455 respectively in source code of
SecurityHeaderCreator
. There is a subtle bug due to operator precedence between ternary operator and addition operator, leading to improper string concatenation.Code in
WsuIdAllocator
anonymous class:Proposed fix: parentheses around ternary operator expression.
After testing proposed solution, WSS processor starts generating unique IDs inside WSS header.