[CXF-6585] Possible to send invalid Soap 1.2 faults

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.2
• Fix Version/s: 3.1.3
• Component/s: Soap Binding
• Estimated Complexity: Unknown
• Assignee: Daniel Kulp
• Reporter: Daniel Kulp
• Created: 08/Sep/15 20:07
• Updated: 14/Oct/16 14:17
• Resolved: 08/Sep/15 20:23

Description

The soap 1.2 spec specifically states that the fault "Code" must be one of the 5 values enumerated in the spec. However, CXF uses the code set in the Fault "as is" without any checks. Thus, faults can be returned that are not processable by compliant clients.

Note: soap 1.1 spec allows the fault code to be any qname. This only applies to 1.2.