Fix WSS4J WS-Security replay detection for validation

Wire Apache WSS4J ReplayCache instances into RequestData from
Wss4jSecurityInterceptor. Introduce SpringReplayCache as a Spring
Cache-backed ReplayCache that stores expiry instants and enforces them
in the contains method (no dependency on the backing cache's own TTL).

Also introduced ConcurrentMapReplayCache for single-node use that use
an in-memory cache.

Closes gh-1837

Author: snicoll

spring-ws-docs/src/docs/asciidoc/security.adoc

@@ -147,6 +147,12 @@ The default is `false`, in line with WSS4J.
 Set it to `true` only when a partner cannot use RSA-OAEP.
 For **outbound** encryption, prefer `setSecurementEncryptionKeyTransportAlgorithm` with `http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p` (or the constant exposed by WSS4J) when the recipient supports it.
 
+==== Replay detection during validation
+
+When you validate `UsernameToken` elements that include `Nonce` and `Created`, validate `Timestamp` tokens, or validate SAML assertions with one-time-use semantics, configure `setValidationReplayCache` with an Apache WSS4J `org.apache.wss4j.common.cache.ReplayCache` implementation.
+Spring-WS registers that cache on the WSS4J `RequestData` for nonce, timestamp, and SAML one-time-use replay checks.
+See `org.springframework.ws.soap.security.wss4j2.cache.SpringReplayCache` for an implementation based on Spring's Cache abstraction.
+
 == Handling Digital Certificates
 
 For cryptographic operations that require interaction with a keystore or certificate handling (signature, encryption, and decryption operations), WSS4J requires an instance of `org.apache.ws.security.components.crypto.Crypto`.

spring-ws-security/build.gradle

@@ -35,7 +35,7 @@ dependencies {
 	}
 	api("org.jvnet.staxex:stax-ex")
 	api("org.slf4j:slf4j-api")
-	api("org.springframework:spring-beans")
+	api("org.springframework:spring-context")
 	api("org.springframework:spring-tx")
 	api("org.springframework.security:spring-security-core")
 

spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java

@@ -29,6 +29,7 @@
 import javax.security.auth.callback.UnsupportedCallbackException;
 
 import org.apache.wss4j.common.ConfigurationConstants;
+import org.apache.wss4j.common.cache.ReplayCache;
 import org.apache.wss4j.common.crypto.Crypto;
 import org.apache.wss4j.common.ext.WSSecurityException;
 import org.apache.wss4j.common.principal.WSUsernameTokenPrincipalImpl;
@@ -137,6 +138,16 @@
  * <p>
  * The order of the actions that the client performed to secure the messages is
  * significant and is enforced by the interceptor.
+ * <p>
+ * For validation, configure an Apache WSS4J {@link ReplayCache} with
+ * {@link #setValidationReplayCache(ReplayCache)} so username-token nonces and (when
+ * applicable) timestamp/signature and SAML one-time-use replay checks run across
+ * requests. By default, the same cache is used for all three; override
+ * {@link #getValidationNonceReplayCache()}, {@link #getValidationTimestampReplayCache()},
+ * or {@link #getValidationSamlOneTimeUseReplayCache()} to use different caches. See
+ * {@link org.springframework.ws.soap.security.wss4j2.cache.SpringReplayCache
+ * SpringReplayCache} for a convenient implementation based on Spring's
+ * {@link org.springframework.cache.Cache Cache abstraction}.
  *
  * @author Tareq Abed Rabbo
  * @author Arjen Poutsma
@@ -211,6 +222,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
 	// To maintain same behavior as default, this flag is set to true
 	private boolean removeSecurityHeader = true;
 
+	private ReplayCache validationReplayCache;
+
 	private List<Pattern> signatureSubjectDnPatterns = Collections.emptyList();
 
 	/**
@@ -703,6 +716,45 @@ public void setRemoveSecurityHeader(boolean removeSecurityHeader) {
 		this.removeSecurityHeader = removeSecurityHeader;
 	}
 
+	/**
+	 * Set the {@link ReplayCache} used during message validation for username-token
+	 * nonces, timestamp/signature replay detection, and SAML one-time-use assertions.
+	 * @since 3.1.9
+	 */
+	public void setValidationReplayCache(ReplayCache validationReplayCache) {
+		this.validationReplayCache = validationReplayCache;
+	}
+
+	/**
+	 * Return the replay cache for {@code UsernameToken} nonces. The default
+	 * implementation returns the cache configured with
+	 * {@link #setValidationReplayCache(ReplayCache)}.
+	 * @since 3.1.9
+	 */
+	protected ReplayCache getValidationNonceReplayCache() {
+		return this.validationReplayCache;
+	}
+
+	/**
+	 * Return the replay cache for timestamp/signature replay detection. The default
+	 * implementation returns the cache configured with
+	 * {@link #setValidationReplayCache(ReplayCache)}.
+	 * @since 3.1.9
+	 */
+	protected ReplayCache getValidationTimestampReplayCache() {
+		return this.validationReplayCache;
+	}
+
+	/**
+	 * Return the replay cache for SAML {@code OneTimeUse} assertions. The default
+	 * implementation returns the cache configured with
+	 * {@link #setValidationReplayCache(ReplayCache)}.
+	 * @since 3.1.9
+	 */
+	protected ReplayCache getValidationSamlOneTimeUseReplayCache() {
+		return this.validationReplayCache;
+	}
+
 	@Override
 	public void afterPropertiesSet() throws Exception {
 
@@ -829,6 +881,19 @@ protected RequestData initializeValidationRequestData(MessageContext messageCont
 		// allow for qualified password types for .Net interoperability
 		requestData.setAllowNamespaceQualifiedPasswordTypes(true);
 
+		ReplayCache nonceReplayCache = getValidationNonceReplayCache();
+		if (nonceReplayCache != null) {
+			requestData.setNonceReplayCache(nonceReplayCache);
+		}
+		ReplayCache timestampReplayCache = getValidationTimestampReplayCache();
+		if (timestampReplayCache != null) {
+			requestData.setTimestampReplayCache(timestampReplayCache);
+		}
+		ReplayCache samlOneTimeUseReplayCache = getValidationSamlOneTimeUseReplayCache();
+		if (samlOneTimeUseReplayCache != null) {
+			requestData.setSamlOneTimeUseReplayCache(samlOneTimeUseReplayCache);
+		}
+
 		requestData.setSubjectCertConstraints(this.signatureSubjectDnPatterns);
 		return requestData;
 	}

spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/cache/ConcurrentMapReplayCache.java

@@ -0,0 +1,67 @@
+/*
+ * Copyright 2005-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.ws.soap.security.wss4j2.cache;
+
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentMap;
+
+import org.springframework.cache.concurrent.ConcurrentMapCache;
+
+/**
+ * {@link SpringReplayCache} backed by an internal {@link ConcurrentMapCache} that sweeps
+ * all expired entries on cache access so keys that are never read again are still removed
+ * once they expire.
+ * <p>
+ * Use this implementation only with single host deployment. Services that are deployment
+ * on multiple hosts should use a distributed cache, see {@link SpringReplayCache} for
+ * options.
+ *
+ * @author Stephane Nicoll
+ * @since 3.1.9
+ */
+public class ConcurrentMapReplayCache extends SpringReplayCache {
+
+	public ConcurrentMapReplayCache() {
+		this(DEFAULT_TTL, MAX_TTL);
+	}
+
+	public ConcurrentMapReplayCache(long defaultTtlSeconds, long maxTtlSeconds) {
+		super(new ConcurrentMapCache("wss4j-replay"), defaultTtlSeconds, maxTtlSeconds);
+	}
+
+	@Override
+	protected void onCacheAccess() {
+		Instant now = Instant.now();
+		ConcurrentMapCache mapCache = (ConcurrentMapCache) getCache();
+		ConcurrentMap<Object, Object> store = mapCache.getNativeCache();
+		List<Object> keysToRemove = new ArrayList<>();
+		for (Map.Entry<Object, Object> entry : store.entrySet()) {
+			Object key = entry.getKey();
+			Object value = entry.getValue();
+			if (value instanceof Instant instant && instant.isBefore(now)) {
+				keysToRemove.add(key);
+			}
+		}
+		for (Object key : keysToRemove) {
+			mapCache.evict(key);
+		}
+	}
+
+}

spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/cache/SpringReplayCache.java

@@ -0,0 +1,143 @@
+/*
+ * Copyright 2005-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.ws.soap.security.wss4j2.cache;
+
+import java.time.Instant;
+
+import org.apache.wss4j.common.cache.MemoryReplayCache;
+import org.apache.wss4j.common.cache.ReplayCache;
+
+import org.springframework.cache.Cache;
+import org.springframework.util.Assert;
+
+/**
+ * Apache WSS4J {@link ReplayCache} backed by a Spring {@link Cache}. Each key stores an
+ * expiry {@link Instant} with configurable TTLs. The default TTL is 5 minutes and the max
+ * TTL is an hour.
+ * <p>
+ * {@link #contains} consults that instant and evicts the entry when it is past expiry.
+ * This does not rely on the backing cache's own TTL configuration.
+ * <p>
+ * Subclasses may override {@link #onCacheAccess()} and to perform additional eviction,
+ * for example, a full sweep over an in-memory cache.
+ * <p>
+ * For multi hosts deployment in production, make sure to use a {@link Cache}
+ * implementation that is distributed, as each host needs to access the same data. For
+ * simple, single host deployment, {@link ConcurrentMapReplayCache} can be used.
+ *
+ * @author Stephane Nicoll
+ * @since 3.1.9
+ * @see ConcurrentMapReplayCache
+ */
+public class SpringReplayCache implements ReplayCache {
+
+	/**
+	 * Default TTL for entries in seconds.
+	 */
+	public static final long DEFAULT_TTL = MemoryReplayCache.DEFAULT_TTL;
+
+	/**
+	 * Maximum TTL for entries in seconds.
+	 */
+	public static final long MAX_TTL = MemoryReplayCache.MAX_TTL;
+
+	private final Cache cache;
+
+	private final long defaultTtlSeconds;
+
+	private final long maxTtlSeconds;
+
+	/**
+	 * Create an instance with the given cache and default TTLs.
+	 * @param cache the cache to use
+	 */
+	public SpringReplayCache(Cache cache) {
+		this(cache, DEFAULT_TTL, MAX_TTL);
+	}
+
+	/**
+	 * Create an instance with the given cache and TTLs.
+	 * @param cache the cache to use
+	 * @param defaultTtlSeconds the default TTL in seconds
+	 * @param maxTtlSeconds the maximum TTL in seconds
+	 */
+	public SpringReplayCache(Cache cache, long defaultTtlSeconds, long maxTtlSeconds) {
+		Assert.notNull(cache, "cache must not be null");
+		Assert.isTrue(defaultTtlSeconds > 0, "defaultTtlSeconds must be positive");
+		Assert.isTrue(maxTtlSeconds >= defaultTtlSeconds, "maxTtlSeconds must be >= defaultTtlSeconds");
+		this.cache = cache;
+		this.defaultTtlSeconds = defaultTtlSeconds;
+		this.maxTtlSeconds = maxTtlSeconds;
+	}
+
+	protected final Cache getCache() {
+		return this.cache;
+	}
+
+	@Override
+	public void add(String identifier) {
+		add(identifier, Instant.now().plusSeconds(this.defaultTtlSeconds));
+	}
+
+	@Override
+	public void add(String identifier, Instant expiry) {
+		if (identifier == null || identifier.isEmpty()) {
+			return;
+		}
+		Instant now = Instant.now();
+		Instant maxExpiry = now.plusSeconds(this.maxTtlSeconds);
+		if (expiry == null || expiry.isBefore(now) || expiry.isAfter(maxExpiry)) {
+			expiry = now.plusSeconds(this.defaultTtlSeconds);
+		}
+		this.cache.put(identifier, expiry);
+		onCacheAccess();
+	}
+
+	@Override
+	public boolean contains(String identifier) {
+		if (identifier == null || identifier.isEmpty()) {
+			return false;
+		}
+		onCacheAccess();
+		Cache.ValueWrapper wrapper = this.cache.get(identifier);
+		if (wrapper == null) {
+			return false;
+		}
+		Object value = wrapper.get();
+		if (!(value instanceof Instant exp)) {
+			return false;
+		}
+		if (exp.isBefore(Instant.now())) {
+			this.cache.evict(identifier);
+			return false;
+		}
+		return true;
+	}
+
+	/**
+	 * Invoked when the cache is accessed, either after an entry has been stored or before
+	 * checking for the presence of one.
+	 */
+	protected void onCacheAccess() {
+	}
+
+	@Override
+	public void close() {
+		this.cache.clear();
+	}
+
+}

spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/cache/package-info.java

@@ -0,0 +1,21 @@
+/*
+ * Copyright 2005-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Spring-backed {@link org.apache.wss4j.common.cache.ReplayCache} implementations for
+ * WSS4J WS-Security.
+ */
+package org.springframework.ws.soap.security.wss4j2.cache;

spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jInterceptorTests.java

@@ -16,6 +16,8 @@
 
 package org.springframework.ws.soap.security.wss4j2;
 
+import org.apache.wss4j.common.cache.MemoryReplayCache;
+import org.apache.wss4j.common.cache.ReplayCache;
 import org.apache.wss4j.dom.engine.WSSecurityEngine;
 import org.apache.wss4j.dom.handler.RequestData;
 import org.junit.jupiter.api.Test;
@@ -148,4 +150,19 @@ void rsa15KeyTransportAlgorithmCanBeEnabled() throws Exception {
 		assertThat(requestData.isAllowRSA15KeyTransportAlgorithm()).isTrue();
 	}
 
+	@Test
+	void validationReplayCachesArePropagatedToRequestData() throws Exception {
+		WSSecurityEngine engine = new WSSecurityEngine();
+		Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor(engine);
+		ReplayCache replayCache = new MemoryReplayCache();
+		interceptor.setValidationReplayCache(replayCache);
+
+		SoapMessage request = loadSoap11Message("empty-soap.xml");
+		MessageContext context = new DefaultMessageContext(request, getSoap11MessageFactory());
+		RequestData requestData = interceptor.initializeValidationRequestData(context);
+		assertThat(requestData.getNonceReplayCache()).isSameAs(replayCache);
+		assertThat(requestData.getTimestampReplayCache()).isSameAs(replayCache);
+		assertThat(requestData.getSamlOneTimeUseReplayCache()).isSameAs(replayCache);
+	}
+
 }