Apache cxf 附件安全性

Question

我尝试让我的 apache cxf 客户端对附件进行签名和加密。因为我现在有了我的解决方案，它确实对邮件正文进行了签名和加密，但它忽略了附件。

我有以下代码：

    Map<String, Object> props = new HashMap<>();
    props.put("action", "Signature Encrypt");
    props.put("signaturePropFile", "client.properties");
    props.put("passwordCallbackClass", "******.KeystorePasswordCallback");
    props.put("user", "node1");
    props.put("signatureKeyIdentifier", "DirectReference");
    props.put("signatureParts",
            "{Element}{http://www.w3.org/2003/05/soap-envelope}Body;" +
                    "{}cid:Attachments;");
    props.put("encryptionParts",
            "{Content}{http://www.w3.org/2003/05/soap-envelope}Body;" +
                    "{Element}cid:Attachments;" );
    props.put("encryptionPropFile", "client.properties");
    props.put("encryptionKeyIdentifier", "IssuerSerial");
    props.put("encryptionKeyTransportAlgorithm",
            "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p");

    WSS4JOutInterceptor wss4jOut = new WSS4JOutInterceptor(props);

    client.getOutInterceptors().add(wss4jOut);

我正在关注this example 来编写我的代码。

而{}cid:Attachments 部分来自this apache page。

Answer 1

问题是 Apache CXF 出于某种原因在将附件添加到消息的拦截器之前运行签名/加密拦截器。

简单的解决方法是添加您自己的 WSS4J 输出/输入拦截器（问题在于两种方式 - 传入/传出消息），在加密/解密/签名（检查）完成之前添加附件。 基本上，您可以打开 SAAJ 拦截器，该拦截器添加附件并将部分代码从 handleMessage 方法复制到拦截器。 对于外部拦截器：

   @Override
    public void handleMessage(SoapMessage mc) throws Fault {
        super.handleMessage(mc);
        SOAPMessage soapMessage = mc.getContent(SOAPMessage.class);
        if (soapMessage != null) {
            if (soapMessage.countAttachments() > 0) {
                if (mc.getAttachments() == null) {
                    mc.setAttachments(new ArrayList<Attachment>(soapMessage
                            .countAttachments()));
                }
                Iterator<AttachmentPart> it = CastUtils.cast(soapMessage.getAttachments());
                while (it.hasNext()) {
                    AttachmentPart part = it.next();
                    String id = AttachmentUtil.cleanContentId(part.getContentId());
                    AttachmentImpl att = new AttachmentImpl(id);
                    try {
                        att.setDataHandler(part.getDataHandler());
                    } catch (SOAPException e) {
                        throw new Fault(e);
                    }
                    Iterator<MimeHeader> it2 = CastUtils.cast(part.getAllMimeHeaders());
                    while (it2.hasNext()) {
                        MimeHeader header = it2.next();
                        att.setHeader(header.getName(), header.getValue());
                    }
                    mc.getAttachments().add(att);
                    it.remove();
                }
            }
        }
    }

在拦截器中：

 @Override
    public void handleMessage(SoapMessage msg) throws Fault {
        super.handleMessage(msg);
        SOAPMessage soapMessage = msg.getContent(SOAPMessage.class);
        soapMessage.removeAllAttachments();
        Collection<Attachment> atts = msg.getAttachments();
        if (atts != null) {
            for (Attachment a : atts) {
                if (a.getDataHandler().getDataSource() instanceof AttachmentDataSource) {
                    try {
                        ((AttachmentDataSource) a.getDataHandler().getDataSource()).cache(msg);
                    } catch (IOException e) {
                        throw new Fault(e);
                    }
                }
                AttachmentPart ap = soapMessage.createAttachmentPart(a.getDataHandler());
                Iterator<String> i = a.getHeaderNames();
                while (i != null && i.hasNext()) {
                    String h = i.next();
                    String val = a.getHeader(h);
                    ap.addMimeHeader(h, val);
                }
                if (StringUtils.isEmpty(ap.getContentId())) {
                    ap.setContentId(a.getId());
                }
                soapMessage.addAttachmentPart(ap);
            }
        }
        msg.setAttachments(Collections.<Attachment>emptyList());
        msg.setContent(SOAPMessage.class, soapMessage);
    }