public void testBareSoapActionSpoofing() throws Exception {
JaxWsProxyFactoryBean pf = new JaxWsProxyFactoryBean();
pf.setServiceClass(Greeter.class);
pf.setAddress(add11);
pf.setBus(bus);
Greeter greeter = (Greeter) pf.create();
assertEquals("sayHi", greeter.sayHi("test"));
assertEquals("sayHi2", greeter.sayHi2("test"));
// Now test spoofing attack
((BindingProvider)greeter).getRequestContext().put(BindingProvider.SOAPACTION_USE_PROPERTY, "true");
((BindingProvider)greeter).getRequestContext().put(
BindingProvider.SOAPACTION_URI_PROPERTY, "SAY_HI_2"
);
try {
greeter.sayHi("test");
fail("Failure expected on spoofing attack");
} catch (Exception ex) {
// expected
}
// Test the other operation
((BindingProvider)greeter).getRequestContext().put(BindingProvider.SOAPACTION_USE_PROPERTY, "true");
((BindingProvider)greeter).getRequestContext().put(
BindingProvider.SOAPACTION_URI_PROPERTY, "SAY_HI_1"
);
try {
greeter.sayHi2("test");
fail("Failure expected on spoofing attack");
} catch (Exception ex) {
// expected
}
// Test a SOAP Action that does not exist in the binding
((BindingProvider)greeter).getRequestContext().put(BindingProvider.SOAPACTION_USE_PROPERTY, "true");
((BindingProvider)greeter).getRequestContext().put(
BindingProvider.SOAPACTION_URI_PROPERTY, "SAY_HI_UNKNOWN"
);
try {
greeter.sayHi("test");
fail("Failure expected on spoofing attack");
} catch (Exception ex) {
// expected
}
}