PM09337: THE JAX-WS RUNTIME ISSUES A CONFUSING ERROR WHEN IT RECEIVES AN INVALID SOAP MESSAGE

PM14847; 6.1.0.29: There is a security exposure related to JAX-WS web services.
6.1.0.33: Java SDK 1.5 SR12 FP1 Cumulative Fix for WebSphere
6.1.0.35: Java SDK 1.5 SR12 FP2 Cumulative Fix for WebSphere
6.1.0.37: Java SDK 1.5 SR12 FP3 Cumulative Fix for WebSphere
6.1.0.47: WebSphere Application Server V6.1 Fix Pack 47
6.1.0.39: Java SDK 1.5 SR12 FP4 Cumulative Fix for WebSphere Application Server
6.1.0.41: Java SDK 1.5 SR12 FP5 Cumulative Fix for WebSphere Application Server
6.1.0.43: Java SDK 1.5 SR13 Cumulative Fix for WebSphere Application Server
6.1.0.45: Java SDK 1.5 SR14 Cumulative Fix for WebSphere Application Server
6.1.0.47: Java SDK 1.5 SR16 Cumulative Fix for WebSphere Application Server

APAR status

• Closed as program error.

Error description

• The IBM WebSphere Application Server JAX-WS runtime received
  an invalid SOAP message from a remote node.  The JAX-WS runtime
  issued an error message that was confusing.
  
  In the customer's scenario, the incoming SOAP message did not
  contain an xml declaration for a prefix (p).  The runtime
  responded with the confusing error message:
  
  javax.xml.stream.XMLStreamException: Attribute
  name "foo" must be followed by the '=' character.
  
  The runtime should have responded with an error message
  similar to:
  
  javax.xml.stream.XMLStreamException: The namespace prefix "p"
  was not declared.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server            *
  *                  Feature Pack for Web Services users of      *
  *                  JAX-WS                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: The JAX-WS runtime issues a confusing   *
  *                      message when an invalid SOAP message    *
  *                      is received.                            *
  ****************************************************************
  * RECOMMENDATION:  Install a fixpack containing this APAR.     *
  ****************************************************************
  When the IBM WebSphere Application Server JAX-WS runtime
  receives an invalid SOAP message from a remote node, the
  JAX-WS runtime issues an error message that is confusing.
  
  For example, if the incoming SOAP message does not
  contain an xml declaration for a prefix (p).  The runtime
  responds with a confusing error message:
  
  javax.xml.stream.XMLStreamException: Attribute
  name "foo" must be followed by the '=' character.
  
  The runtime should respond with an error message similar to:
  
  javax.xml.stream.XMLStreamException: The namespace prefix "p"
  was not declared.
  
  Note: If the incoming message is invalid for a different
  reason, the JAX-WS runtime may respond with an error different
  than the one listed above.
  

Problem conclusion

• The JAX-WS runtime uses a StAX parser to receive the incoming
  message.  If the StAX parser encounters an error, it will
  throw an exception and leave the StAX parser in an invalid
  state.  Subsequent uses of the StAX parser may cause the
  parser to throw other (confusing) errors.
  
  The JAX-WS runtime is changed to remember the state of the
  StAX parser.  If the parser is in an invalid state, it will
  not be used and the prior exception will be re-thrown.  This
  fix ensures that the customer will see the original error.
  
  This same problem is fixed in the V7 WebSphere Application
  Server by APAR PM09339.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 6.1.0.33.  Please refer to the Recommended Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  PM09339

Fix information

• Fixed component name

  WEBSERVIC FEATU

• Fixed component ID

  5724J0850

Applicable component levels

• R610 PSY

     UP