escapestudios/EscapeWSSEAuthenticationBundle — pull request #42 by magabriel (2014-04-26 18:34:19+00:00)
Title: Fix malformed X-WSSE header vulnerability

This PR fixes two vulnerabilities related to not set or malformed X-WSSE header.

Both problems happen because the current code assumes an "allowed by default" policy, while "denied by default" is a safer assumption.

### 1.- No X-WSSE header in request

if no X-WSSE header is set, authentication must be denied; otherwise it would be trivial to bypass the security just by sending a request without the X-WSSE header.

### 2.- Malformed X-WSSE header

If the X-WSSE header is present but malformed the authentication must also be denied, or again it would be trivial to bypass.

I added one unit test for each one of the fixes.

BTW, thanks for this marvelous bundle!!!