You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@santuario.apache.org by co...@apache.org on 2011/12/08 12:56:31 UTC
svn commit: r1211847 [2/2] - in /santuario/xml-security-java/trunk:
samples/org/apache/xml/security/samples/
samples/org/apache/xml/security/samples/transforms/
src/main/java/org/apache/jcp/xml/dsig/internal/dom/
src/main/java/org/apache/xml/security/a...
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/utils/JDKXPathAPI.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/utils/JDKXPathAPI.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/utils/JDKXPathAPI.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/utils/JDKXPathAPI.java Thu Dec 8 11:56:30 2011
@@ -18,11 +18,13 @@
*/
package org.apache.xml.security.utils;
+import javax.xml.XMLConstants;
import javax.xml.transform.TransformerException;
import javax.xml.xpath.XPath;
import javax.xml.xpath.XPathConstants;
import javax.xml.xpath.XPathExpressionException;
import javax.xml.xpath.XPathFactory;
+import javax.xml.xpath.XPathFactoryConfigurationException;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;
@@ -32,9 +34,11 @@ import org.w3c.dom.NodeList;
*/
public class JDKXPathAPI implements XPathAPI {
- private String xpathStr = null;
+ private XPathFactory xpf;
+
+ private String xpathStr;
- private XPath xpath = null;
+ private XPath xpath;
/**
* Use an XPath string to select a nodelist.
@@ -52,7 +56,14 @@ public class JDKXPathAPI implements XPat
Node contextNode, Node xpathnode, String str, Node namespaceNode
) throws TransformerException {
if (!str.equals(xpathStr) || xpath == null) {
- XPathFactory xpf = XPathFactory.newInstance();
+ if (xpf == null) {
+ xpf = XPathFactory.newInstance();
+ try {
+ xpf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (XPathFactoryConfigurationException ex) {
+ throw new TransformerException("empty", ex);
+ }
+ }
xpath = xpf.newXPath();
xpath.setNamespaceContext(new DOMNamespaceContext(namespaceNode));
xpathStr = str;
@@ -74,7 +85,14 @@ public class JDKXPathAPI implements XPat
public boolean evaluate(Node contextNode, Node xpathnode, String str, Node namespaceNode)
throws TransformerException {
if (!str.equals(xpathStr) || xpath == null) {
- XPathFactory xpf = XPathFactory.newInstance();
+ if (xpf == null) {
+ xpf = XPathFactory.newInstance();
+ try {
+ xpf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (XPathFactoryConfigurationException ex) {
+ throw new TransformerException("empty", ex);
+ }
+ }
xpath = xpf.newXPath();
xpath.setNamespaceContext(new DOMNamespaceContext(namespaceNode));
xpathStr = str;
@@ -92,6 +110,7 @@ public class JDKXPathAPI implements XPat
public void clear() {
xpathStr = null;
xpath = null;
+ xpf = null;
}
}
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/utils/resolver/ResourceResolver.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/utils/resolver/ResourceResolver.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/utils/resolver/ResourceResolver.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/utils/resolver/ResourceResolver.java Thu Dec 8 11:56:30 2011
@@ -67,6 +67,22 @@ public class ResourceResolver {
*/
public static final ResourceResolver getInstance(Attr uri, String baseURI)
throws ResourceResolverException {
+ return getInstance(uri, baseURI, false);
+ }
+
+ /**
+ * Method getInstance
+ *
+ * @param uri
+ * @param baseURI
+ * @param secureValidation
+ * @return the instance
+ *
+ * @throws ResourceResolverException
+ */
+ public static final ResourceResolver getInstance(
+ Attr uri, String baseURI, boolean secureValidation
+ ) throws ResourceResolverException {
synchronized (resolverList) {
for (ResourceResolver resolver : resolverList) {
ResourceResolver resolverTmp = resolver;
@@ -88,6 +104,15 @@ public class ResourceResolver {
}
if ((resolverTmp != null) && resolverTmp.canResolve(uri, baseURI)) {
+ // Check to see whether the Resolver is allowed
+ if (secureValidation
+ && (resolverTmp.resolverSpi instanceof ResolverLocalFilesystem
+ || resolverTmp.resolverSpi instanceof ResolverDirectHTTP)) {
+ Object exArgs[] = { resolverTmp.resolverSpi.getClass().getName() };
+ throw new ResourceResolverException(
+ "signature.Reference.ForbiddenResolver", exArgs, uri, baseURI
+ );
+ }
return resolverTmp;
}
}
@@ -111,6 +136,23 @@ public class ResourceResolver {
public static ResourceResolver getInstance(
Attr uri, String baseURI, List<ResourceResolver> individualResolvers
) throws ResourceResolverException {
+ return getInstance(uri, baseURI, individualResolvers, false);
+ }
+
+ /**
+ * Method getInstance
+ *
+ * @param uri
+ * @param baseURI
+ * @param individualResolvers
+ * @param secureValidation
+ * @return the instance
+ *
+ * @throws ResourceResolverException
+ */
+ public static ResourceResolver getInstance(
+ Attr uri, String baseURI, List<ResourceResolver> individualResolvers, boolean secureValidation
+ ) throws ResourceResolverException {
if (log.isDebugEnabled()) {
log.debug(
"I was asked to create a ResourceResolver and got "
@@ -136,7 +178,7 @@ public class ResourceResolver {
}
}
- return getInstance(uri, baseURI);
+ return getInstance(uri, baseURI, secureValidation);
}
/**
Added: santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/JSRForbiddenRefCountTest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/JSRForbiddenRefCountTest.java?rev=1211847&view=auto
==============================================================================
--- santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/JSRForbiddenRefCountTest.java (added)
+++ santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/JSRForbiddenRefCountTest.java Thu Dec 8 11:56:30 2011
@@ -0,0 +1,83 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package javax.xml.crypto.test.dsig;
+
+import java.io.File;
+import java.security.Security;
+
+import javax.xml.crypto.MarshalException;
+import javax.xml.crypto.dom.DOMCryptoContext;
+
+import org.apache.jcp.xml.dsig.internal.dom.DOMSignedInfo;
+import org.apache.xml.security.utils.Constants;
+import org.w3c.dom.Element;
+
+/**
+ * This is a test for a forbidden number of references when secure validation is enabled.
+ */
+public class JSRForbiddenRefCountTest extends org.junit.Assert {
+
+ static {
+ Security.insertProviderAt(new org.apache.jcp.xml.dsig.internal.dom.XMLDSigRI(), 1);
+ }
+
+ @org.junit.Test
+ public void testReferenceCount() throws Exception {
+ Element signedInfoElement =
+ getSignedInfoElement("src/test/resources/interop/c14n/Y4", "signature-manifest.xml");
+
+ InternalDOMCryptoContext context = new InternalDOMCryptoContext();
+ new DOMSignedInfo(signedInfoElement, context, null);
+
+ context.setProperty("org.apache.jcp.xml.dsig.secureValidation", Boolean.TRUE);
+ try {
+ new DOMSignedInfo(signedInfoElement, context, null);
+ } catch (MarshalException ex) {
+ String error =
+ "A maxiumum of 30 references per Manifest are allowed with secure validation";
+ assertTrue(ex.getMessage().contains(error));
+ }
+ }
+
+ private static class InternalDOMCryptoContext extends DOMCryptoContext {
+ //
+ }
+
+ private Element getSignedInfoElement(
+ String directory, String file
+ ) throws Exception {
+ String basedir = System.getProperty("basedir");
+ if (basedir != null && !"".equals(basedir)) {
+ directory = basedir + "/" + directory;
+ }
+
+ File f = new File(directory + "/" + file);
+ javax.xml.parsers.DocumentBuilderFactory dbf =
+ javax.xml.parsers.DocumentBuilderFactory.newInstance();
+
+ dbf.setNamespaceAware(true);
+
+ javax.xml.parsers.DocumentBuilder db = dbf.newDocumentBuilder();
+ org.w3c.dom.Document doc = db.parse(f);
+
+ return (Element) doc.getElementsByTagNameNS(Constants.SignatureSpecNS,
+ Constants._TAG_SIGNEDINFO).item(0);
+ }
+
+}
Added: santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/JSRForbiddenReferenceTest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/JSRForbiddenReferenceTest.java?rev=1211847&view=auto
==============================================================================
--- santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/JSRForbiddenReferenceTest.java (added)
+++ santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/JSRForbiddenReferenceTest.java Thu Dec 8 11:56:30 2011
@@ -0,0 +1,74 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package javax.xml.crypto.test.dsig;
+
+import java.io.File;
+import java.security.Security;
+
+import javax.xml.crypto.dsig.XMLSignatureException;
+import javax.xml.crypto.dsig.dom.DOMValidateContext;
+import javax.xml.crypto.test.KeySelectors;
+import javax.xml.crypto.test.dsig.SignatureValidator;
+
+/**
+ * This is a test for a forbidden Reference algorithm when secure validation is enabled.
+ */
+public class JSRForbiddenReferenceTest extends org.junit.Assert {
+
+ private SignatureValidator validator;
+ private File dir;
+
+ static {
+ Security.insertProviderAt(new org.apache.jcp.xml.dsig.internal.dom.XMLDSigRI(), 1);
+ }
+
+ public JSRForbiddenReferenceTest() {
+ String fs = System.getProperty("file.separator");
+ String base = System.getProperty("basedir") == null ? "./": System.getProperty("basedir");
+
+ dir = new File(base + fs + "src/test/resources" + fs
+ + "javax" + fs + "xml" + fs + "crypto", "dsig");
+ validator = new SignatureValidator(dir);
+ }
+
+
+ @org.junit.Test
+ public void testLocalFilesystem() throws Exception {
+ String file = "signature-external-c14n-xmlatrs.xml";
+
+ DOMValidateContext vc =
+ validator.getValidateContext(
+ file, new KeySelectors.SecretKeySelector("secret".getBytes("ASCII"))
+ );
+
+ vc.setProperty("org.apache.jcp.xml.dsig.secureValidation", Boolean.FALSE);
+ boolean coreValidity = validator.validate(vc);
+ assertTrue("Signature failed core validation", coreValidity);
+
+ vc.setProperty("org.apache.jcp.xml.dsig.secureValidation", Boolean.TRUE);
+
+ try {
+ validator.validate(vc);
+ fail("Failure expected when secure validation is enabled");
+ } catch (XMLSignatureException ex) {
+ assertTrue(ex.getMessage().contains("URIReferenceException"));
+ }
+ }
+
+}
Modified: santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/SignatureValidator.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/SignatureValidator.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/SignatureValidator.java (original)
+++ santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/SignatureValidator.java Thu Dec 8 11:56:30 2011
@@ -87,7 +87,7 @@ public class SignatureValidator {
if (coreValidity == false) {
// check the validation status of each Reference
Iterator<?> i = signature.getSignedInfo().getReferences().iterator();
- for (int j = 0; i.hasNext(); j++) {
+ while (i.hasNext()) {
Reference reference = (Reference) i.next();
reference.validate(vc);
}
Added: santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenAlgorithmTest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenAlgorithmTest.java?rev=1211847&view=auto
==============================================================================
--- santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenAlgorithmTest.java (added)
+++ santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenAlgorithmTest.java Thu Dec 8 11:56:30 2011
@@ -0,0 +1,86 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.xml.security.test.secure_val;
+
+import java.io.File;
+
+import org.apache.xml.security.signature.XMLSignature;
+import org.apache.xml.security.signature.XMLSignatureException;
+import org.apache.xml.security.test.interop.InteropTestBase;
+import org.apache.xml.security.utils.Constants;
+import org.w3c.dom.Element;
+
+
+/**
+ * This is a test for a forbidden algorithm (MD5) when secure validation is enabled.
+ */
+public class ForbiddenAlgorithmTest extends InteropTestBase {
+
+ /** {@link org.apache.commons.logging} logging facility */
+ static org.apache.commons.logging.Log log =
+ org.apache.commons.logging.LogFactory.getLog(ForbiddenAlgorithmTest.class.getName());
+
+ static {
+ org.apache.xml.security.Init.init();
+ }
+
+ public ForbiddenAlgorithmTest() {
+ super();
+ }
+
+ @org.junit.Test
+ public void testMD5Digest() throws Exception {
+ boolean success =
+ readAndVerifySignature("src/test/resources/interop/c14n/Y2", "signature-joseph-exc.xml", false);
+
+ assertTrue(success);
+
+ try {
+ readAndVerifySignature("src/test/resources/interop/c14n/Y2", "signature-joseph-exc.xml", true);
+ fail("Failure expected when secure validation is enabled");
+ } catch (XMLSignatureException ex) {
+ assertTrue(ex.getMessage().contains("no XMLSignatureInput"));
+ }
+ }
+
+ private boolean readAndVerifySignature(
+ String directory, String file, boolean secValidation
+ ) throws Exception {
+ String basedir = System.getProperty("basedir");
+ if (basedir != null && !"".equals(basedir)) {
+ directory = basedir + "/" + directory;
+ }
+
+ File f = new File(directory + "/" + file);
+ javax.xml.parsers.DocumentBuilderFactory dbf =
+ javax.xml.parsers.DocumentBuilderFactory.newInstance();
+
+ dbf.setNamespaceAware(true);
+
+ javax.xml.parsers.DocumentBuilder db = dbf.newDocumentBuilder();
+ org.w3c.dom.Document doc = db.parse(f);
+
+ Element sigElement =
+ (Element) doc.getElementsByTagNameNS(Constants.SignatureSpecNS,
+ Constants._TAG_SIGNATURE).item(0);
+ XMLSignature signature = new XMLSignature(sigElement, f.toURI().toURL().toString(), secValidation);
+ return signature.checkSignatureValue(signature.getKeyInfo().getPublicKey());
+ }
+
+}
Added: santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenRefCountTest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenRefCountTest.java?rev=1211847&view=auto
==============================================================================
--- santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenRefCountTest.java (added)
+++ santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenRefCountTest.java Thu Dec 8 11:56:30 2011
@@ -0,0 +1,86 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.xml.security.test.secure_val;
+
+import java.io.File;
+
+import org.apache.xml.security.exceptions.XMLSecurityException;
+import org.apache.xml.security.signature.Manifest;
+import org.apache.xml.security.test.interop.InteropTestBase;
+import org.apache.xml.security.utils.Constants;
+import org.w3c.dom.Element;
+
+
+/**
+ * This is a test for a forbidden number of references when secure validation is enabled.
+ */
+public class ForbiddenRefCountTest extends InteropTestBase {
+
+ /** {@link org.apache.commons.logging} logging facility */
+ static org.apache.commons.logging.Log log =
+ org.apache.commons.logging.LogFactory.getLog(ForbiddenRefCountTest.class.getName());
+
+ static {
+ org.apache.xml.security.Init.init();
+ }
+
+ public ForbiddenRefCountTest() {
+ super();
+ }
+
+ @org.junit.Test
+ public void testReferenceCount() throws Exception {
+ boolean success =
+ readAndVerifyManifest("src/test/resources/interop/c14n/Y4", "signature-manifest.xml", false);
+
+ assertTrue(success);
+
+ try {
+ readAndVerifyManifest("src/test/resources/interop/c14n/Y4", "signature-manifest.xml", true);
+ fail("Failure expected when secure validation is enabled");
+ } catch (XMLSecurityException ex) {
+ assertTrue(ex.getMessage().contains("references are contained in the Manifest"));
+ }
+ }
+
+ private boolean readAndVerifyManifest(
+ String directory, String file, boolean secValidation
+ ) throws Exception {
+ String basedir = System.getProperty("basedir");
+ if (basedir != null && !"".equals(basedir)) {
+ directory = basedir + "/" + directory;
+ }
+
+ File f = new File(directory + "/" + file);
+ javax.xml.parsers.DocumentBuilderFactory dbf =
+ javax.xml.parsers.DocumentBuilderFactory.newInstance();
+
+ dbf.setNamespaceAware(true);
+
+ javax.xml.parsers.DocumentBuilder db = dbf.newDocumentBuilder();
+ org.w3c.dom.Document doc = db.parse(f);
+
+ Element manifestElement =
+ (Element) doc.getElementsByTagNameNS(Constants.SignatureSpecNS,
+ Constants._TAG_SIGNEDINFO).item(0);
+ Manifest manifest = new Manifest(manifestElement, f.toURI().toURL().toString(), secValidation);
+ return manifest.verifyReferences();
+ }
+
+}
Added: santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenReferenceTest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenReferenceTest.java?rev=1211847&view=auto
==============================================================================
--- santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenReferenceTest.java (added)
+++ santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenReferenceTest.java Thu Dec 8 11:56:30 2011
@@ -0,0 +1,86 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.xml.security.test.secure_val;
+
+import java.io.File;
+
+import org.apache.xml.security.signature.Manifest;
+import org.apache.xml.security.signature.MissingResourceFailureException;
+import org.apache.xml.security.test.interop.InteropTestBase;
+import org.apache.xml.security.utils.Constants;
+import org.w3c.dom.Element;
+
+
+/**
+ * This is a test for a forbidden Reference algorithm when secure validation is enabled.
+ */
+public class ForbiddenReferenceTest extends InteropTestBase {
+
+ /** {@link org.apache.commons.logging} logging facility */
+ static org.apache.commons.logging.Log log =
+ org.apache.commons.logging.LogFactory.getLog(ForbiddenReferenceTest.class.getName());
+
+ static {
+ org.apache.xml.security.Init.init();
+ }
+
+ public ForbiddenReferenceTest() {
+ super();
+ }
+
+ @org.junit.Test
+ public void testLocalFilesystem() throws Exception {
+ boolean success =
+ readAndVerifyManifest("src/test/resources/interop/c14n/Y3", "signature.xml", false);
+
+ assertTrue(success);
+
+ try {
+ readAndVerifyManifest("src/test/resources/interop/c14n/Y3", "signature.xml", true);
+ fail("Failure expected when secure validation is enabled");
+ } catch (MissingResourceFailureException ex) {
+ assertTrue(ex.getMessage().contains("The Reference for URI"));
+ }
+ }
+
+ private boolean readAndVerifyManifest(
+ String directory, String file, boolean secValidation
+ ) throws Exception {
+ String basedir = System.getProperty("basedir");
+ if (basedir != null && !"".equals(basedir)) {
+ directory = basedir + "/" + directory;
+ }
+
+ File f = new File(directory + "/" + file);
+ javax.xml.parsers.DocumentBuilderFactory dbf =
+ javax.xml.parsers.DocumentBuilderFactory.newInstance();
+
+ dbf.setNamespaceAware(true);
+
+ javax.xml.parsers.DocumentBuilder db = dbf.newDocumentBuilder();
+ org.w3c.dom.Document doc = db.parse(f);
+
+ Element manifestElement =
+ (Element) doc.getElementsByTagNameNS(Constants.SignatureSpecNS,
+ Constants._TAG_SIGNEDINFO).item(0);
+ Manifest manifest = new Manifest(manifestElement, f.toURI().toURL().toString(), secValidation);
+ return manifest.verifyReferences();
+ }
+
+}
Added: santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenRetrievalMethodTest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenRetrievalMethodTest.java?rev=1211847&view=auto
==============================================================================
--- santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenRetrievalMethodTest.java (added)
+++ santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenRetrievalMethodTest.java Thu Dec 8 11:56:30 2011
@@ -0,0 +1,66 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.xml.security.test.secure_val;
+
+import java.io.FileInputStream;
+
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+
+import org.apache.xml.security.keys.KeyInfo;
+import org.w3c.dom.Document;
+
+
+/**
+ * This is a test for a Retrieval Method pointing to another Retrieval Method (forbidden under
+ * secure validation).
+ */
+public class ForbiddenRetrievalMethodTest extends org.junit.Assert {
+
+ private static final String BASEDIR = System.getProperty("basedir");
+ private static final String SEP = System.getProperty("file.separator");
+
+ public ForbiddenRetrievalMethodTest() {
+ org.apache.xml.security.Init.init();
+ }
+
+ @org.junit.Test
+ public void testMultipleRetrievalMethods() throws Exception {
+ FileInputStream fis = null;
+ String filename = "src/test/resources/org/apache/xml/security/keyresolver/retrievalmethod3.xml";
+ if (BASEDIR != null && !"".equals(BASEDIR)) {
+ fis = new FileInputStream(BASEDIR + SEP + filename);
+ } else {
+ fis = new FileInputStream(filename);
+ }
+
+ DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+ dbf.setNamespaceAware(true);
+ DocumentBuilder db = dbf.newDocumentBuilder();
+ Document doc = db.parse(fis);
+
+ KeyInfo keyInfo = new KeyInfo(doc.getDocumentElement(), null);
+ keyInfo.setSecureValidation(true);
+
+ // Check neither of these give a StackOverflowError.
+ assertNull(keyInfo.getPublicKey());
+ assertNull(keyInfo.getX509Certificate());
+ }
+
+}
Added: santuario/xml-security-java/trunk/src/test/resources/interop/c14n/Y4/signature-manifest.xml
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/test/resources/interop/c14n/Y4/signature-manifest.xml?rev=1211847&view=auto
==============================================================================
--- santuario/xml-security-java/trunk/src/test/resources/interop/c14n/Y4/signature-manifest.xml (added)
+++ santuario/xml-security-java/trunk/src/test/resources/interop/c14n/Y4/signature-manifest.xml Thu Dec 8 11:56:30 2011
@@ -0,0 +1,520 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<foo:Root xmlns:bar="http://example.org/bar" xmlns:baz="http://example.org/baz" xmlns:foo="http://example.org/foo" xmlns="http://example.org/" xml:lang="en-ie">
+ <bar:Something>
+ <foo:Something>
+ <bar:Something>
+ <foo:Something>
+ <baz:Something />
+ </foo:Something>
+ </bar:Something>
+ </foo:Something>
+ </bar:Something>
+ <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
+ <SignedInfo>
+ <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
+ <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" />
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- everything -->
+ ancestor-or-self::bar:Something
+ </XPath>
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>lCOS/JtpmOE+4eXFaOpY4v4BOgI=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only text, elements or directly-used namespace nodes -->
+ ancestor-or-self::bar:Something and
+ ((name() != "bar") or parent::bar:Something) and
+ ((name() != "foo") or parent::foo:Something) and
+ ((name() != "baz") or parent::baz:Something) and
+ ((name() != "") or self::text())
+ </XPath>
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>OyVqEWXE7C+5NyKtceUkdmiFO9A=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only text, elements or directly-used namespace nodes -->
+ ancestor-or-self::bar:Something and
+ (self::text() or
+ (namespace-uri() != "") or
+ (string(self::node()) = namespace-uri(parent::node())))
+ </XPath>
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>OyVqEWXE7C+5NyKtceUkdmiFO9A=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only text, elements, or directly-used namespace nodes but not foo:Something -->
+ ancestor-or-self::bar:Something and
+ not (self::foo:Something) and
+ (self::text() or
+ (namespace-uri() != "") or
+ (string(self::node()) = namespace-uri(parent::node())))
+ </XPath>
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>mL1aAQ/RoOPO0SHj9KR+yY3n4CM=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- no namespace nodes; I am not in my parent's namespace axis -->
+ ancestor-or-self::bar:Something and
+ (count(parent::node()/namespace::*) !=
+ count(parent::node()/namespace::* | self::node()))
+ </XPath>
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>bQgF8ICymYZTuUP0FE40l3Q7BZk=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- no namespace nodes; I am text or have nonempty namespace URI -->
+ ancestor-or-self::bar:Something and
+ (self::text() or
+ (namespace-uri() != ""))
+ </XPath>
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>bQgF8ICymYZTuUP0FE40l3Q7BZk=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only namespace nodes -->
+ ancestor-or-self::bar:Something and
+ (count(parent::node()/namespace::*) =
+ count(parent::node()/namespace::* | self::node()))
+ </XPath>
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>IJQgd59FJ1PAxxCY5mIL6cZemi0=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only directly-used namespace nodes -->
+ ancestor-or-self::bar:Something and
+ (string(self::node()) = namespace-uri(parent::node()))
+ </XPath>
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>SXGijO1eArEaXGphF0dxwj5fp1g=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- no namespace nodes but the default on alternate elements -->
+ ancestor-or-self::bar:Something and
+ (self::text() or
+ (namespace-uri() != "") or
+ ((name() = "") and
+ ((count(ancestor-or-self::node()) mod 2) = 1)))
+ </XPath>
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>rNm4Id9ah12nugzXAUJgjas7ls0=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- everything -->
+ ancestor-or-self::bar:Something
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>Wa7sEWwUmSNsv6p75omGKXL6rjI=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only text, elements or directly-used namespace nodes -->
+ ancestor-or-self::bar:Something and
+ ((name() != "bar") or parent::bar:Something) and
+ ((name() != "foo") or parent::foo:Something) and
+ ((name() != "baz") or parent::baz:Something) and
+ ((name() != "") or self::text())
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>Wa7sEWwUmSNsv6p75omGKXL6rjI=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only text, elements or directly-used namespace nodes -->
+ ancestor-or-self::bar:Something and
+ (self::text() or
+ (namespace-uri() != "") or
+ (string(self::node()) = namespace-uri(parent::node())))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>Wa7sEWwUmSNsv6p75omGKXL6rjI=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only text, elements, or directly-used namespace nodes but not foo:Something -->
+ ancestor-or-self::bar:Something and
+ not (self::foo:Something) and
+ (self::text() or
+ (namespace-uri() != "") or
+ (string(self::node()) = namespace-uri(parent::node())))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>uOQJQIIUETYyk0+YEBdbEQwrYbw=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- no namespace nodes; I am not in my parent's namespace axis -->
+ ancestor-or-self::bar:Something and
+ (count(parent::node()/namespace::*) !=
+ count(parent::node()/namespace::* | self::node()))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>6Wmm693F38R+R8E9DZM+MVXXMME=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- no namespace nodes; I am text or have nonempty namespace URI -->
+ ancestor-or-self::bar:Something and
+ (self::text() or
+ (namespace-uri() != ""))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>6Wmm693F38R+R8E9DZM+MVXXMME=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only namespace nodes -->
+ ancestor-or-self::bar:Something and
+ (count(parent::node()/namespace::*) =
+ count(parent::node()/namespace::* | self::node()))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>2jmj7l5rSw0yVb/vlWAYkK/YBwk=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only directly-used namespace nodes -->
+ ancestor-or-self::bar:Something and
+ (string(self::node()) = namespace-uri(parent::node()))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>2jmj7l5rSw0yVb/vlWAYkK/YBwk=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- no namespace nodes but the default on alternate elements -->
+ ancestor-or-self::bar:Something and
+ (self::text() or
+ (namespace-uri() != "") or
+ ((name() = "") and
+ ((count(ancestor-or-self::node()) mod 2) = 1)))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>6Wmm693F38R+R8E9DZM+MVXXMME=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- everything -->
+ ancestor-or-self::bar:Something
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+ <InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default" />
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>AWtqDbXWKf8TV78C2d16uarbpGk=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only text, elements or directly-used namespace nodes -->
+ ancestor-or-self::bar:Something and
+ ((name() != "bar") or parent::bar:Something) and
+ ((name() != "foo") or parent::foo:Something) and
+ ((name() != "baz") or parent::baz:Something) and
+ ((name() != "") or self::text())
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+ <InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default" />
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>Wa7sEWwUmSNsv6p75omGKXL6rjI=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only text, elements or directly-used namespace nodes -->
+ ancestor-or-self::bar:Something and
+ (self::text() or
+ (namespace-uri() != "") or
+ (string(self::node()) = namespace-uri(parent::node())))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+ <InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default" />
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>Wa7sEWwUmSNsv6p75omGKXL6rjI=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only text, elements, or directly-used namespace nodes but not foo:Something -->
+ ancestor-or-self::bar:Something and
+ not (self::foo:Something) and
+ (self::text() or
+ (namespace-uri() != "") or
+ (string(self::node()) = namespace-uri(parent::node())))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+ <InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default" />
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>uOQJQIIUETYyk0+YEBdbEQwrYbw=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- no namespace nodes; I am not in my parent's namespace axis -->
+ ancestor-or-self::bar:Something and
+ (count(parent::node()/namespace::*) !=
+ count(parent::node()/namespace::* | self::node()))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+ <InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default" />
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>6Wmm693F38R+R8E9DZM+MVXXMME=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- no namespace nodes; I am text or have nonempty namespace URI -->
+ ancestor-or-self::bar:Something and
+ (self::text() or
+ (namespace-uri() != ""))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+ <InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default" />
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>6Wmm693F38R+R8E9DZM+MVXXMME=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only namespace nodes -->
+ ancestor-or-self::bar:Something and
+ (count(parent::node()/namespace::*) =
+ count(parent::node()/namespace::* | self::node()))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+ <InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default" />
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>NpjMPzEF5YZFbz4ls7eN36QWdXs=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- only directly-used namespace nodes -->
+ ancestor-or-self::bar:Something and
+ (string(self::node()) = namespace-uri(parent::node()))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+ <InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default" />
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>2jmj7l5rSw0yVb/vlWAYkK/YBwk=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- no namespace nodes but the default on alternate elements -->
+ ancestor-or-self::bar:Something and
+ (self::text() or
+ (namespace-uri() != "") or
+ ((name() = "") and
+ ((count(ancestor-or-self::node()) mod 2) = 1)))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+ <InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default" />
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>EacBN2aBBNSjpCOzZUOOvSv4zHU=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- no namespace nodes but the default on alternate elements -->
+ ancestor-or-self::bar:Something and
+ (self::text() or
+ (namespace-uri() != "") or
+ ((name() = "") and
+ ((count(ancestor-or-self::node()) mod 2) = 1)))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+ <InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default" />
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>EacBN2aBBNSjpCOzZUOOvSv4zHU=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- no namespace nodes but the default on alternate elements -->
+ ancestor-or-self::bar:Something and
+ (self::text() or
+ (namespace-uri() != "") or
+ ((name() = "") and
+ ((count(ancestor-or-self::node()) mod 2) = 1)))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+ <InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default" />
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>EacBN2aBBNSjpCOzZUOOvSv4zHU=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- no namespace nodes but the default on alternate elements -->
+ ancestor-or-self::bar:Something and
+ (self::text() or
+ (namespace-uri() != "") or
+ ((name() = "") and
+ ((count(ancestor-or-self::node()) mod 2) = 1)))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+ <InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default" />
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>EacBN2aBBNSjpCOzZUOOvSv4zHU=</DigestValue>
+ </Reference>
+ <Reference URI="">
+ <Transforms>
+ <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+ <XPath>
+ <!-- no namespace nodes but the default on alternate elements -->
+ ancestor-or-self::bar:Something and
+ (self::text() or
+ (namespace-uri() != "") or
+ ((name() = "") and
+ ((count(ancestor-or-self::node()) mod 2) = 1)))
+ </XPath>
+ </Transform>
+ <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+ <InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default" />
+ </Transform>
+ </Transforms>
+ <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+ <DigestValue>EacBN2aBBNSjpCOzZUOOvSv4zHU=</DigestValue>
+ </Reference>
+ </SignedInfo>
+ </Signature>
+</foo:Root>
Added: santuario/xml-security-java/trunk/src/test/resources/org/apache/xml/security/keyresolver/retrievalmethod3.xml
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/test/resources/org/apache/xml/security/keyresolver/retrievalmethod3.xml?rev=1211847&view=auto
==============================================================================
--- santuario/xml-security-java/trunk/src/test/resources/org/apache/xml/security/keyresolver/retrievalmethod3.xml (added)
+++ santuario/xml-security-java/trunk/src/test/resources/org/apache/xml/security/keyresolver/retrievalmethod3.xml Thu Dec 8 11:56:30 2011
@@ -0,0 +1,5 @@
+<dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
+ <dsig:RetrievalMethod xml:id="r1" URI="#r2"/>
+ <dsig:RetrievalMethod xml:id="r2" URI="#r3"/>
+ <dsig:RetrievalMethod xml:id="r3" URI="#r1"/>
+</dsig:KeyInfo>
\ No newline at end of file