Incorrect namespace prefixes included in PrefixList due to having colon in attribute value within SOAP Body

[Tomas-Kraus]

When creating a SOAP request with the Body signed, for any attribute values within the SOAP Body that contain a ":", the text before the colon is interpreted incorrectly as an XML namespace prefix, and subsequently added to the InclusiveNamespaces PrefixList attribute.

Since there are no namespaces registered for these incorrectly identified prefixes, these values should not be included in the PrefixList.

The existence of these invalid prefixes breaks web service implementations using Apache WSS4J/XML Security (and possibly other WSS implementations), since it uses the PrefixList on the request to insert namespace attributes in the canonicalized SOAP Body element, and therefore the digest created differs from that of the Metro-based digest.

Example:

Metro-based canonicalized output (on which the request digest is generated):

<S:Body xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
  <AccountInfo xmlns="http://test.com/">
    <Address attentionLine="attn:Mr. Smith"/>
  </AccountInfo>
</S:Body>

Since Metro finds that the attentionLine attribute value begins with "attn:", it interprets the "attn" token as a prefix and adds it to the PrefixList in the SOAP request:

<exc14n:InclusiveNamespaces xmlns:exc14n="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="S attn"/>

Once this request is sent to the web service, the Apache WSS4J implementation uses the PrefixList to insert namespace declarations into the canonicalized SOAP Body element:

<S:Body xmlns:S="http://schemas.xmlsoap.org/soap/envelope/" xmlns:attn="">
  <AccountInfo xmlns="http://test.com/">
    <Address attentionLine="attn:Mr. Smith"/>
  </AccountInfo>
</S:Body>

Since the digest generated from this version of the SOAP Body element will differ from the digest on the request, verification fails.

Environment

JDK 1.7.0_71
Mac OS X 10.10.4
Metro 2.3.1

Affected Versions

[2.3]

Source: javaee/metro-wsit#1695
Author: glassfishrobot