[RAMPART-52] UsernameToken Builder Bug.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.2
• Fix Version/s: 1.3
• Component/s: rampart-policy
• Environment: Axis 1.2 and Rampart 1.2
• Assignee: Ruchith B. Gunaratne
• Reporter: Jochen Zink
• Created: 05/Jul/07 08:10
• Updated: 06/Jul/07 06:56
• Resolved: 05/Jul/07 11:37

Description

The class org.apache.ws.secpolicy.builders.UsernameTokenBuilder has an bug inside the build Method.

This method tries to receive the include attribute of the usernameToken defined in a WS-Policy:

OMAttribute attribute = element.getAttribute(Constants.INCLUDE_TOKEN);
String inclusionValue = attribute.getAttributeValue();

The problem is, in WS-SecurityPolocy Specification [1], Chapter 6.3.1 defined, that this include token is optional!

A Policy with UsernameToken without the include attribute will raises a NullPointer Exception.

[1] http://specs.xmlsoap.org/ws/2005/07/securitypolicy/ws-securitypolicy.pdf