Details
-
Bug
-
Status: Resolved
-
Minor
-
Resolution: Fixed
-
None
-
None
-
any
Description
The serialize method in org.apache.ws.secpolicy.model.SignedEncryptedElements causes duplicate namespace declaration in the assertion. The bug seems to be introduced as a result of the bug fix to Rampart issue 123. The problematic code is:
// xmlns:sp=".."
writer.writeNamespace(prefix, namespaceURI);
if (writerPrefix == null)
{ // xmlns:sp=".." writer.writeNamespace(prefix, namespaceURI); }Normally the writer prefix won't be null, however if the SignedEncryptedElements assertion is the first in the policy and no prior declarations of the security policy namespace exist, the writer prefix is null and the namespace is declared twice, resulting in an exception when parsed afterwards.