From 45eb691a588924400460dd18e7f3f412adee4347 Mon Sep 17 00:00:00 2001
From: Philip Helger <philip@helger.com>
Date: Wed, 7 Aug 2024 10:31:22 +0200
Subject: [PATCH] Make sure that wildcard lookups including a "*" in the
 Customization ID will always fail

---
 README.md                                            |  2 ++
 .../smpclient/peppol/PeppolWildcardSelector.java     |  6 ++++++
 .../smpclient/peppol/PeppolWildcardSelectorTest.java | 12 ++++++++++++
 3 files changed, 20 insertions(+)

diff --git a/README.md b/README.md
index 72b30723..5142cc12 100644
--- a/README.md
+++ b/README.md
@@ -300,6 +300,8 @@ They depend on several other libraries so I suggest you are going for the Maven
 
 # News and noteworthy
 
+* v9.5.1 - work in progress
+    * Make sure that wildcard lookups including a "*" in the Customization ID will always fail
 * v9.5.0 - 2024-07-29
     * Updated to dnsjava 3.6 fixing CVE-2024-25638
     * Added new submodule `dbnalliance-xhe`. See [#53](https://github.com/phax/peppol-commons/pull/53) - thx @robinsongarciax
diff --git a/peppol-smp-client/src/main/java/com/helger/smpclient/peppol/PeppolWildcardSelector.java b/peppol-smp-client/src/main/java/com/helger/smpclient/peppol/PeppolWildcardSelector.java
index afd76bc4..bd70037e 100644
--- a/peppol-smp-client/src/main/java/com/helger/smpclient/peppol/PeppolWildcardSelector.java
+++ b/peppol-smp-client/src/main/java/com/helger/smpclient/peppol/PeppolWildcardSelector.java
@@ -183,6 +183,12 @@ public void forEachMatchingDocumentType (@Nonnull final ICommonsList <? extends
 
         // Iterate all the peppol-doctype-wildcard stuff
         String sRemainingCustomizationID = aParts.getCustomizationID ();
+        if (sRemainingCustomizationID.indexOf (PeppolIdentifierHelper.DOCUMENT_TYPE_WILDCARD_INDICATOR) >= 0)
+        {
+          // If a Customization contains a "*" it is invalid - no match
+          return EContinue.BREAK;
+        }
+
         IDocumentTypeIdentifier aSelectedDocTypeID = aFuncCheckExistance.apply (PeppolIdentifierHelper.DOCUMENT_TYPE_SCHEME_PEPPOL_DOCTYPE_WILDCARD,
                                                                                 aFuncCustIDToDocTypeIDValue.apply (sRemainingCustomizationID +
                                                                                                                    PeppolIdentifierHelper.DOCUMENT_TYPE_WILDCARD_INDICATOR));
diff --git a/peppol-smp-client/src/test/java/com/helger/smpclient/peppol/PeppolWildcardSelectorTest.java b/peppol-smp-client/src/test/java/com/helger/smpclient/peppol/PeppolWildcardSelectorTest.java
index ad26d475..e9d85d92 100644
--- a/peppol-smp-client/src/test/java/com/helger/smpclient/peppol/PeppolWildcardSelectorTest.java
+++ b/peppol-smp-client/src/test/java/com/helger/smpclient/peppol/PeppolWildcardSelectorTest.java
@@ -128,6 +128,18 @@ public void testMatchingModesAll ()
       aMatches.clear ();
     }
 
+    {
+      final PeppolWildcardSelector aSelector = new PeppolWildcardSelector (EMode.WILDCARD_ONLY);
+      // Customization ID with * will never match
+      aSelector.forEachMatchingDocumentType (aSupportedDocTypes,
+                                             "urn:oasis:names:specification:ubl:schema:xsd:Invoice-2::Invoice##urn:peppol:pint:billing-1@jp-1*::2.1",
+                                             aMatcherCount);
+      assertEquals (0, aMatches.size ());
+
+      // Reset
+      aMatches.clear ();
+    }
+
     {
       final PeppolWildcardSelector aSelector = new PeppolWildcardSelector (EMode.BUSDOX_THEN_WILDCARD);
       aSelector.forEachMatchingDocumentType (aSupportedDocTypes,