This Google search reveals a ton of similar potential bugs: http://www.google.com/codesearch?hl=en&q=digest\.equals+file%3A\.java%24 http://www.google.com/code

This Google search reveals a ton of similar potential bugs: http://www.google.com/codesearch?hl=en&q=digest\.equals+file%3A\.java%24 http://www.google.com/codesearch?hl=en&q=digest\.equals+... For example, it looks like org.apache.ws.security.processor.UsernameTokenProcessor.handleUsernameToken might be vulnerable (although WS-Security's nonces and timestamps make things more complicated, since you have to generate a timestamp like a week in the future, and then hope that the server does the digest comparison before rejecting you based on the nonce or timestamp): http://www.google.com/codesearch/p?hl=en&sa=N&cd=31&ct=rc#UKcntCYb8Dw/trunk/src/org/apache/ws/security/processor/UsernameTokenProcessor.java&q=digest\.equals%20file:\.java$ http://www.google.com/codesearch/p?hl=en&sa=N&cd=31&...