{"record":{"id":"187db786ac15c07b","repo":"apereo/cas","slug":"existing-soap-envelope-body-already-contained-chil","errorCode":null,"errorMessage":"Existing SOAP Envelope Body already contained children","messagePattern":"Existing SOAP Envelope Body already contained children","errorType":"console","errorClass":null,"httpStatus":null,"severity":"info","filePath":"support/cas-server-support-saml-core-api/src/main/java/org/apereo/cas/support/saml/util/CasHttpSoap11Encoder.java","lineNumber":45,"sourceCode":"\n @Override\n protected void buildAndStoreSOAPMessage(\n @NonNull\n final XMLObject payload) {\n val builderFactory = XMLObjectProviderRegistrySupport.getBuilderFactory();\n\n val envBuilder =\n (SOAPObjectBuilder) builderFactory.getBuilder(Envelope.DEFAULT_ELEMENT_NAME);\n val envelope = envBuilder.buildObject(\n SOAPConstants.SOAP11_NS, Envelope.DEFAULT_ELEMENT_LOCAL_NAME, OPENSAML_11_SOAP_NS_PREFIX);\n\n val bodyBuilder =\n (SOAPObjectBuilder) builderFactory.getBuilder(Body.DEFAULT_ELEMENT_NAME);\n val body = bodyBuilder.buildObject(\n SOAPConstants.SOAP11_NS, Body.DEFAULT_ELEMENT_LOCAL_NAME, OPENSAML_11_SOAP_NS_PREFIX);\n\n if (!body.getUnknownXMLObjects().isEmpty()) {\n LOGGER.warn(\"Existing SOAP Envelope Body already contained children\");\n }\n\n body.getUnknownXMLObjects().add(payload);\n envelope.setBody(body);\n this.storeSOAPEnvelope(envelope);\n }\n\n}\n","sourceCodeStart":27,"sourceCodeEnd":54,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-core-api/src/main/java/org/apereo/cas/support/saml/util/CasHttpSoap11Encoder.java#L27-L54","documentation":"CasHttpSoap11Encoder.buildAndStoreSOAPMessage() constructs a SOAP 1.1 Envelope with a single Body and stores the outgoing message. If the freshly built Body already contains unknown XMLObjects, it logs this warning before appending the payload, indicating leftover/pre-existing children in the Body that may yield an unexpected SOAP message structure. It is defensive logging rather than a hard failure.","triggerScenarios":"Reusing an encoder or SOAP object tree where the Body element was previously populated (e.g. the encoder instance is reused across requests or the OpenSAML builder returns a cached/shared Body).","commonSituations":"Custom SAML SOAP encoding code reusing a single encoder instance for multiple messages; incorrectly wiring the OpenSAML builderFactory so it returns shared objects; embedding the encoder in a singleton Spring bean with state carried between calls.","solutions":["Create a fresh CasHttpSoap11Encoder (and SOAP message context) per request instead of reusing instances","Verify the payload is added exactly once and no earlier code populated the Body","Inspect the produced SOAP envelope to confirm only the intended payload is present","If the warning is benign in your flow, ensure the added payload ordering still satisfies the SAML binding spec"],"exampleFix":"// before: shared encoder field\nprivate final CasHttpSoap11Encoder encoder = new CasHttpSoap11Encoder(...);\n// after: per-use instance\nval encoder = new CasHttpSoap11Encoder(builderFactory);\nencoder.buildAndStoreSOAPMessage(payload);","handlingStrategy":"type-guard","validationCode":"// ensure a clean encoder/message per send\nassert encoderNotReused && body.getUnknownXMLObjects().isEmpty();","typeGuard":"function bodyIsEmpty(body) { return body.getUnknownXMLObjects().isEmpty(); }","tryCatchPattern":"if (!body.getUnknownXMLObjects().isEmpty()) {\n log.warn('SOAP body pre-populated; constructing fresh envelope');\n encoder = newEncoder();\n}","preventionTips":["Instantiate a new SOAP encoder per message","Do not cache OpenSAML objects across requests","Verify the generated envelope contains exactly one payload"],"tags":["saml","soap","encoder","opensusi","state"],"backgroundTag":"invalid-state-transition","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}