[kali834x]

jsonbaseddefaultdispatcher.findService picks the service from the namespace of the soap body's first element. that is the content-based dispatch SOAPMessageBodyBasedDispatcher and SOAPMessageBodyBasedServiceDispatcher now refuse unless allowContentBasedServiceDispatch is set (ContentBasedDispatchPolicy), because Dispatch runs after the Security phase. the json copy of that code kept the old behaviour, and it is the only Dispatch-phase dispatcher in the spring-boot-starter axis2-json.xml, whose application/xml builder puts the caller's root element in the body: a POST whose uri names no service, carrying <x:a xmlns:x="http://h/axis2/services/Target"/>, binds Target after Security has already run against no service. apply the same policy check at the top of findService. json-rpc requests carry an empty body, so their dispatch is unchanged. JSONBasedDefaultDispatcherTest fails before the change; the kernel, json and spring-boot-starter tests pass after.

[robertlazarski]

Merged to master as fa0a9e5 (rebased onto master, so GitHub didn't detect the merge). Thanks!