Upgrade to org.apache.santuario:xmlsec:3.0.2

[cachescrubber]

In Version 3.0.1 Apache Santuario introduced a Bug which could cause applications using org.springframework.ws.soap.security.wss4j2.Wss4jSecurityInterceptor to block indefinitely. We already created an upstream Issue SANTUARIO-598 .

Spring Web Services should consider to downgrade the managed dependency to org.apache.santuario:xmlsec:3.0.0 or at least add a warning in the release notes.

Here is a typical Thread Dump of an affected application.

"http-nio-8080-exec-1" - Thread t@24
   java.lang.Thread.State: BLOCKED
	at java.base@17.0.6/sun.security.provider.NativePRNG$RandomIO.implNextBytes(NativePRNG.java:547)
	- waiting to lock <577bfadd> (a java.lang.Object) owned by "http-nio-8080-exec-8" t@31
	at java.base@17.0.6/sun.security.provider.NativePRNG$Blocking.engineNextBytes(NativePRNG.java:269)
	at java.base@17.0.6/java.security.SecureRandom.nextBytes(SecureRandom.java:758)
	at org.apache.xml.security.stax.ext.XMLSecurityConstants.generateBytes(XMLSecurityConstants.java:85)
	at org.apache.wss4j.dom.util.WSSecurityUtil.generateNonce(WSSecurityUtil.java:644)
	at org.apache.wss4j.dom.message.token.UsernameToken.addNonce(UsernameToken.java:291)
	at org.apache.wss4j.dom.message.token.UsernameToken.<init>(UsernameToken.java:258)
	at org.apache.wss4j.dom.message.WSSecUsernameToken.prepare(WSSecUsernameToken.java:170)
	at org.apache.wss4j.dom.message.WSSecUsernameToken.build(WSSecUsernameToken.java:231)
	at org.apache.wss4j.dom.message.WSSecUsernameToken.build(WSSecUsernameToken.java:238)
	at org.apache.wss4j.dom.action.UsernameTokenAction.execute(UsernameTokenAction.java:69)
	at org.apache.wss4j.dom.handler.WSHandler.doSenderAction(WSHandler.java:240)
	at org.springframework.ws.soap.security.wss4j2.Wss4jHandler.doSenderAction(Wss4jHandler.java:58)
	at org.springframework.ws.soap.security.wss4j2.Wss4jSecurityInterceptor.secureMessage(Wss4jSecurityInterceptor.java:609)
	at org.springframework.ws.soap.security.AbstractWsSecurityInterceptor.handleRequest(AbstractWsSecurityInterceptor.java:206)
	at org.springframework.ws.client.core.WebServiceTemplate.doSendAndReceive(WebServiceTemplate.java:575)
	at org.springframework.ws.client.core.WebServiceTemplate.sendAndReceive(WebServiceTemplate.java:538)
	at org.springframework.ws.client.core.WebServiceTemplate.marshalSendAndReceive(WebServiceTemplate.java:390)

To mitigate the issue, the system property org.apache.xml.security.securerandom.algorithm could be set to use a non-blocking algorithm.

  @PostConstruct
  public void init() {
    // SANTUARIO-589 - Enable configurable RNG in initialization of XMlSecurityConstants
    // override RNG algorithm, otherwise a BLOCKING algorithm is used.
    System.getProperties().setProperty("org.apache.xml.security.securerandom.algorithm", "SHA1PRNG");
  }

[gregturn]

See apache/santuario-xml-security-java#120 for the original patch to XMLSEC.