[jira] [Updated] (SANTUARIO-309) Default XMLCipher canonicalizer may decrypt element to the wrong namespace

["Clement Pellerin (Updated) (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/SANTUARIO-309?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Clement Pellerin updated SANTUARIO-309:
---------------------------------------

    Attachment: SANTUARIO-309.diff

Here is a patch that implements the non-standard Physical XML Canonicalization and makes it the default in XMLCipher. This algorithm is not a real canonicalization since it preserves the physical representation. It is implemented as a canonicalizer to fit in the current framework. The canonicalizer name is a parameter of the XMLCipher.

The attributes are still sorted, so in theory if the initialization vector is the same, the encryption could produce the same result on physically equivalent documents.

A junit is provided with some cases documented in SANTUARIO-308.

Have you ever noticed that C14N is mis-spelled N14C in XMLCipher public static constants? To keep it consistent, I mis-spelled the new constant name too.
                
> Default XMLCipher canonicalizer may decrypt element to the wrong namespace
> --------------------------------------------------------------------------
>
>                 Key: SANTUARIO-309
>                 URL: https://issues.apache.org/jira/browse/SANTUARIO-309
>             Project: Santuario
>          Issue Type: Bug
>          Components: Java
>    Affects Versions: Java 1.4.5, Java 1.5.1
>            Reporter: Clement Pellerin
>            Assignee: Colm O hEigeartaigh
>         Attachments: SANTUARIO-309.diff, TestC14N.java
>
>
> The default XMLCipher canonicalizer is Inclusive XML C14N with comments. This canonicalization has the problem described in the XML Encryption spec section 4.3.3. If the encrypted element <elem> undeclares the default namespace inherited from its parent, the resulting decrypted element is missing the undeclaration and therefore the element lays in the wrong namespace.
> In this example, <elem> moves from the global namespace to the http://default.com namespace.
> <env:Envelope xmlns="http://default.com" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"><env:Body><elem xmlns="">11</elem></env:Body></env:Envelope>"
> It would be tempting to use Exclusive XML C14N, but this algorithm also has problems. It removes namespace declarations that are not visibly used. If the namespace prefix is used only in text mode, the algorithm cannot detect it.
> I would argue that the best way to solve this problem is to create a non-standard canonicalization that simply emits the nodes as is. This is like a pretty-printer without indenting.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira