Uploaded image for project: 'PicketBox '
  1. PicketBox
  2. SECURITY-561

JBossResponseContext getResult strips multiple obligations from the evaluation response.

    Details

    • Steps to Reproduce:
      Hide

      Create a policy that results in multiple obligations getting applied. Upon receiving the response, view the obligations, only the last evaluated obligation will remain.

      Show
      Create a policy that results in multiple obligations getting applied. Upon receiving the response, view the obligations, only the last evaluated obligation will remain.
    • Estimated Difficulty:
      Low

      Description

      The getResult() method in JBossResponseContext prevents multiple Obligations from getting returned to the PEP. The code block:
      //Obligations
      Set<Obligation> obligationsSet = result.getObligations();
      if(obligationsSet != null)
      {
      for(Obligation obl:obligationsSet)

      { ObligationType obType = new ObligationType(); obType.setObligationId(obl.getId().toASCIIString()); obType.setFulfillOn(EffectType.fromValue(Result.DECISIONS[obl.getFulfillOn()])); ObligationsType obligationsType = new ObligationsType(); obligationsType.getObligation().add(obType); resultType.setObligations(obligationsType); }

      }

      Causes the obligations to constantly get overwritten with the last one read in.
      --> resultType.setObligations(obligationsType)

      To fix, do something more like:
      // Obligations
      Set<Obligation> obligationsSet = result.getObligations();
      if (obligationsSet != null && obligationsSet.size() > 0) {
      ObligationsType obligationsType = new ObligationsType();
      for (Obligation obl : obligationsSet)

      { ObligationType obType = new ObligationType(); obType.setObligationId(obl.getId().toASCIIString()); obType.setFulfillOn(EffectType.fromValue(Result.DECISIONS[obl.getFulfillOn()])); obligationsType.getObligation().add(obType); }


      resultType.setObligations(obligationsType);
      }

        Gliffy Diagrams

          Attachments

            Activity

              People

              • Assignee:
                anil.saldhana Anil Saldanha
                Reporter:
                bkrisler Brian Krisler
              • Votes:
                0 Vote for this issue
                Watchers:
                0 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: