Retire the WSSE AtomPub authentication mode

app/src/main/java/org/apache/roller/weblogger/webservices/atomprotocol/RollerAtomHandler.java

@@ -29,15 +29,13 @@
 import org.apache.roller.weblogger.pojos.User;
 import org.apache.roller.weblogger.pojos.WeblogEntry;
 import org.apache.roller.weblogger.pojos.Weblog;
-import org.apache.roller.weblogger.util.WSSEUtilities;
 import com.rometools.propono.atom.common.AtomService;
 import com.rometools.propono.atom.server.AtomException;
 import com.rometools.propono.atom.server.AtomHandler;
 import com.rometools.propono.atom.server.AtomMediaResource;
 import com.rometools.propono.atom.server.AtomNotFoundException;
 import com.rometools.rome.feed.atom.Entry;
 import com.rometools.rome.feed.atom.Feed;
-import java.nio.charset.StandardCharsets;
 import javax.servlet.http.HttpServletResponse;
 import net.oauth.OAuthAccessor;
 import net.oauth.OAuthMessage;
@@ -118,15 +116,15 @@ public RollerAtomHandler(HttpServletRequest request, HttpServletResponse respons
         roller = WebloggerFactory.getWeblogger();
 
         String userName;
-        if ("oauth".equals(WebloggerRuntimeConfig.getProperty("webservices.atomPubAuth"))) {
+        String authenticationMethod =
+                WebloggerRuntimeConfig.getProperty("webservices.atomPubAuth");
+        if ("oauth".equals(authenticationMethod)) {
             userName = authenticationOAUTH(request, response);
-
-        } else if ("wsse".equals(WebloggerRuntimeConfig.getProperty("webservices.atomPubAuth"))) {
-            userName = authenticateWSSE(request);
-
-        } else {
-            // default to basic
+        } else if ("basic".equals(authenticationMethod)) {
             userName = authenticateBASIC(request);
+        } else {
+            log.warn("Unsupported AtomPub authentication method; authentication denied");
+            userName = null;
         }
 
         if (userName != null) {
@@ -410,53 +408,6 @@ public static boolean canView(User u, Weblog website) {
 
     //-------------------------------------------------------------- authentication
 
-    /**
-     * Perform WSSE authentication based on information in request.
-     * Will not work if Weblogger password encryption is turned on.
-     */
-    protected String authenticateWSSE(HttpServletRequest request) {
-        String wsseHeader = request.getHeader("X-WSSE");
-        String ret = null;
-        if (wsseHeader == null) {
-            return ret;
-        }
-        String userName = null;
-        String created = null;
-        String nonce = null;
-        String passwordDigest = null;
-        String[] tokens = wsseHeader.split(",");
-        for (int i = 0; i < tokens.length; i++) {
-            int index = tokens[i].indexOf('=');
-            if (index != -1) {
-                String key = tokens[i].substring(0, index).trim();
-                String value = tokens[i].substring(index + 1).trim();
-                value = value.replace("\"", "");
-                if (key.startsWith("UsernameToken")) {
-                    userName = value;
-                } else if (key.equalsIgnoreCase("nonce")) {
-                    nonce = value;
-                } else if (key.equalsIgnoreCase("passworddigest")) {
-                    passwordDigest = value;
-                } else if (key.equalsIgnoreCase("created")) {
-                    created = value;
-                }
-            }
-        }
-        String digest = null;
-        try {
-            User inUser = roller.getUserManager().getUserByUserName(userName);
-            digest = WSSEUtilities.generateDigest(WSSEUtilities.base64Decode(nonce),
-                    created.getBytes(StandardCharsets.UTF_8),
-                    inUser.getPassword().getBytes(StandardCharsets.UTF_8));
-            if (digest.equals(passwordDigest)) {
-                ret = userName;
-            }
-        } catch (Exception e) {
-            log.error("During wsseAuthenticataion: " + e.getMessage(), e);
-        }
-        return ret;
-    }
-
     /**
      * BASIC authentication.
      */

app/src/main/resources/ApplicationResources.properties

@@ -338,7 +338,7 @@ configForm.editorPages=Editor Pages
 
 configForm.webServicesSettings=Web Services Settings
 configForm.enableAtomPub=Enable Atom Publishing Protocol
-configForm.AtomPubAuth=AtomPub authentication (basic, oauth, or wsse)
+configForm.AtomPubAuth=AtomPub authentication (basic or oauth)
 configForm.enableXmlRpc=Enable Blogger / MetaWeblog API
 
 configForm.weblogSettings=Weblog Rendering Settings

app/src/main/resources/ApplicationResources_ja.properties

@@ -1383,7 +1383,7 @@ pingTargetAdd.subtitle=Ping\u30BF\u30FC\u30B2\u30C3\u30C8\u306E\u8FFD\u52A0
 planetSubscription.feedUrl=\u30CB\u30E5\u30FC\u30B9\u30D5\u30A3\u30FC\u30C9URL
 mediaFileSuccess.noEnclosure=\u30A8\u30F3\u30AF\u30ED\u30FC\u30B8\u30E3\u306A\u3057
 userRegister.tip.ready=\u3088\u308D\u3057\u3051\u308C\u3070\u3001\u4EE5\u4E0B\u306E\u30DC\u30BF\u30F3\u3092\u30AF\u30EA\u30C3\u30AF\u3057\u3066\u304F\u3060\u3055\u3044\u3002
-configForm.AtomPubAuth=AtomPub\u8A8D\u8A3C (basic, oauth, \u307E\u305F\u306F wsse)
+configForm.AtomPubAuth=AtomPub\u8A8D\u8A3C (basic \u307E\u305F\u306F oauth)
 ConfigForm.proxyPort=Feed fetcher\u304C\u4F7F\u7528\u3059\u308B\u30D7\u30ED\u30AD\u30B7\u306E\u30DD\u30FC\u30C8
 mediaFileView.searchTitle=\u691C\u7D22\u7D50\u679C
 weblogEdit.enclosureLength=\u9577\u3055

app/src/main/resources/ApplicationResources_zh_CN.properties

@@ -337,7 +337,7 @@ configForm.editorPages=\u7F16\u8F91\u5668\u9875\u9762
 
 configForm.webServicesSettings=Web\u670D\u52A1\u8BBE\u7F6E
 configForm.enableAtomPub=\u542F\u7528 Atom \u53D1\u5E03\u534F\u8BAE
-configForm.AtomPubAuth=AtomPub \u8BA4\u8BC1\u65B9\u5F0F (basic / oauth / wsse)
+configForm.AtomPubAuth=AtomPub \u8BA4\u8BC1\u65B9\u5F0F (basic / oauth)
 configForm.enableXmlRpc=\u542F\u7528 Blogger / MetaWeblog API
 
 configForm.weblogSettings=\u535A\u5BA2\u663E\u793A\u8BBE\u7F6E
@@ -1878,4 +1878,3 @@ user.account.activation.mail.subject=Roller\uFF1A\u4F60\u7684\u8D26\u53F7\u6FC0\
 user.account.activation.mail.content=<html><body style=\"background: white; color: black; font-size: 12px\"><p>\u8981\u6FC0\u6D3B\u4F60\u7684Roller\u8D26\u6237[{1}]\uFF0C\u8BF7\u70B9\u51FB\u4EE5\u4E0B\u94FE\u63A5\uFF1A</p><p><a href=\"{2}\">{2}</a></p></body></html>
 
 
-

app/src/test/java/org/apache/roller/weblogger/webservices/atomprotocol/RollerAtomHandlerTest.java

@@ -0,0 +1,95 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0.
+ */
+package org.apache.roller.weblogger.webservices.atomprotocol;
+
+import org.apache.roller.weblogger.business.URLStrategy;
+import org.apache.roller.weblogger.business.UserManager;
+import org.apache.roller.weblogger.business.Weblogger;
+import org.apache.roller.weblogger.business.WebloggerFactory;
+import org.apache.roller.weblogger.config.WebloggerRuntimeConfig;
+import org.apache.roller.weblogger.pojos.User;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.MockitoAnnotations;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.time.Instant;
+import java.util.Base64;
+
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.mockito.Mockito.mockStatic;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+class RollerAtomHandlerTest {
+
+    private static final String USER_NAME = "alice";
+    private static final String PASSWORD = "test-password";
+
+    @Mock
+    private HttpServletRequest request;
+
+    @Mock
+    private HttpServletResponse response;
+
+    @Mock
+    private Weblogger weblogger;
+
+    @Mock
+    private UserManager userManager;
+
+    @Mock
+    private URLStrategy urlStrategy;
+
+    @BeforeEach
+    void setUp() throws Exception {
+        MockitoAnnotations.openMocks(this);
+
+        User user = new User();
+        user.setUserName(USER_NAME);
+        user.setPassword(PASSWORD);
+
+        when(weblogger.getUserManager()).thenReturn(userManager);
+        when(weblogger.getUrlStrategy()).thenReturn(urlStrategy);
+        when(urlStrategy.getAtomProtocolURL(true)).thenReturn("https://example.test/app");
+        when(userManager.getUserByUserName(USER_NAME)).thenReturn(user);
+    }
+
+    @Test
+    void wsseAuthenticationModeIsRejected() throws Exception {
+        String created = Instant.now().toString();
+        byte[] nonce = "test-nonce".getBytes(StandardCharsets.UTF_8);
+        MessageDigest digester = MessageDigest.getInstance("SHA-1");
+        digester.update(nonce);
+        digester.update(created.getBytes(StandardCharsets.UTF_8));
+        digester.update(PASSWORD.getBytes(StandardCharsets.UTF_8));
+        String digest = Base64.getEncoder().encodeToString(digester.digest());
+        when(request.getHeader("X-WSSE")).thenReturn(
+                "UsernameToken Username=\"" + USER_NAME
+                + "\", PasswordDigest=\"" + digest
+                + "\", Nonce=\"" + Base64.getEncoder().encodeToString(nonce)
+                + "\", Created=\"" + created + "\"");
+
+        try (MockedStatic<WebloggerFactory> factory = mockStatic(WebloggerFactory.class);
+             MockedStatic<WebloggerRuntimeConfig> config = mockStatic(WebloggerRuntimeConfig.class)) {
+            factory.when(WebloggerFactory::getWeblogger).thenReturn(weblogger);
+            config.when(() -> WebloggerRuntimeConfig.getProperty("webservices.atomPubAuth"))
+                    .thenReturn("wsse");
+
+            RollerAtomHandler handler = new RollerAtomHandler(request, response);
+
+            assertNull(handler.getAuthenticatedUsername());
+            verify(request, never()).getHeader("Authorization");
+        }
+    }
+}