You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@santuario.apache.org by co...@apache.org on 2013/11/01 16:25:18 UTC
svn commit: r1537956 - in
/santuario/xml-security-java/branches/1.5.x-fixes/src:
main/java/org/apache/jcp/xml/dsig/internal/dom/
main/java/org/apache/xml/security/c14n/
main/java/org/apache/xml/security/encryption/
main/java/org/apache/xml/security/key...
Author: coheigea
Date: Fri Nov 1 15:25:17 2013
New Revision: 1537956
URL: http://svn.apache.org/r1537956
Log:
Disallow doc type declarations when secure validation is enabled
Conflicts:
src/main/java/org/apache/xml/security/c14n/Canonicalizer.java
Modified:
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheCanonicalizer.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheTransform.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMCanonicalXMLC14N11Method.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMCanonicalXMLC14NMethod.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMExcC14NMethod.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMReference.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMRetrievalMethod.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMURIDereferencer.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/c14n/Canonicalizer.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/c14n/CanonicalizerSpi.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/AbstractSerializer.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/DocumentSerializer.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/XMLCipher.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/KeyInfoReferenceResolver.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/RetrievalMethodResolver.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/Manifest.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/SignedInfo.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/XMLSignatureInput.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/Transform.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/TransformSpi.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/Transforms.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformBase64Decode.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N11.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N11_WithComments.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NExclusive.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NExclusiveWithComments.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NWithComments.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformXSLT.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/XMLUtils.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverAnonymous.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverDirectHTTP.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverFragment.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverLocalFilesystem.java
santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverXPointer.java
santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/JSRWrappingAttackTest.java
santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/SignatureValidator.java
santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/TestUtils.java
santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/XMLSignatureFactoryTest.java
santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/Canonicalizer11Test.java
santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/Canonicalizer20010315Test.java
santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/ExclusiveC14NInteropTest.java
santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/interop/InteropTestBase.java
santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenAlgorithmTest.java
santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/secure_val/WrappingAttackTest.java
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheCanonicalizer.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheCanonicalizer.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheCanonicalizer.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheCanonicalizer.java Fri Nov 1 15:25:17 2013
@@ -30,6 +30,7 @@ import java.io.OutputStream;
import java.security.spec.AlgorithmParameterSpec;
import java.security.InvalidAlgorithmParameterException;
import java.util.Set;
+
import javax.xml.crypto.*;
import javax.xml.crypto.dom.DOMCryptoContext;
import javax.xml.crypto.dsig.TransformException;
@@ -112,6 +113,8 @@ public abstract class ApacheCanonicalize
if (apacheCanonicalizer == null) {
try {
apacheCanonicalizer = Canonicalizer.getInstance(getAlgorithm());
+ boolean secVal = Utils.secureValidation(xc);
+ apacheCanonicalizer.setSecureValidation(secVal);
if (log.isDebugEnabled()) {
log.debug("Created canonicalizer for algorithm: " + getAlgorithm());
}
@@ -249,6 +252,9 @@ public abstract class ApacheCanonicalize
}
}
+ boolean secVal = Utils.secureValidation(xc);
+ in.setSecureValidation(secVal);
+
try {
in = apacheTransform.performTransform(in, os);
if (!in.isNodeSet() && !in.isElement()) {
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheTransform.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheTransform.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheTransform.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheTransform.java Fri Nov 1 15:25:17 2013
@@ -28,10 +28,10 @@ import java.io.OutputStream;
import java.security.InvalidAlgorithmParameterException;
import java.security.spec.AlgorithmParameterSpec;
import java.util.Set;
+
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.Node;
-
import org.apache.xml.security.signature.XMLSignatureInput;
import org.apache.xml.security.transforms.Transform;
import org.apache.xml.security.transforms.Transforms;
@@ -187,6 +187,8 @@ public abstract class ApacheTransform ex
throw new TransformException(ex);
}
}
+ boolean secVal = Utils.secureValidation(xc);
+ in.setSecureValidation(secVal);
try {
if (os != null) {
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMCanonicalXMLC14N11Method.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMCanonicalXMLC14N11Method.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMCanonicalXMLC14N11Method.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMCanonicalXMLC14N11Method.java Fri Nov 1 15:25:17 2013
@@ -64,6 +64,8 @@ public final class DOMCanonicalXMLC14N11
if (subTree.excludeComments()) {
try {
apacheCanonicalizer = Canonicalizer.getInstance(C14N_11);
+ boolean secVal = Utils.secureValidation(xc);
+ apacheCanonicalizer.setSecureValidation(secVal);
} catch (InvalidCanonicalizerException ice) {
throw new TransformException
("Couldn't find Canonicalizer for: " +
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMCanonicalXMLC14NMethod.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMCanonicalXMLC14NMethod.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMCanonicalXMLC14NMethod.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMCanonicalXMLC14NMethod.java Fri Nov 1 15:25:17 2013
@@ -61,6 +61,8 @@ public final class DOMCanonicalXMLC14NMe
try {
apacheCanonicalizer = Canonicalizer.getInstance
(CanonicalizationMethod.INCLUSIVE);
+ boolean secVal = Utils.secureValidation(xc);
+ apacheCanonicalizer.setSecureValidation(secVal);
} catch (InvalidCanonicalizerException ice) {
throw new TransformException
("Couldn't find Canonicalizer for: " +
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMExcC14NMethod.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMExcC14NMethod.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMExcC14NMethod.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMExcC14NMethod.java Fri Nov 1 15:25:17 2013
@@ -33,8 +33,8 @@ import javax.xml.crypto.dsig.spec.Transf
import java.security.InvalidAlgorithmParameterException;
import java.security.spec.AlgorithmParameterSpec;
import java.util.*;
-import org.w3c.dom.Element;
+import org.w3c.dom.Element;
import org.apache.xml.security.c14n.Canonicalizer;
import org.apache.xml.security.c14n.InvalidCanonicalizerException;
@@ -144,6 +144,8 @@ public final class DOMExcC14NMethod exte
try {
apacheCanonicalizer = Canonicalizer.getInstance
(CanonicalizationMethod.EXCLUSIVE);
+ boolean secVal = Utils.secureValidation(xc);
+ apacheCanonicalizer.setSecureValidation(secVal);
} catch (InvalidCanonicalizerException ice) {
throw new TransformException
("Couldn't find Canonicalizer for: " +
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMReference.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMReference.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMReference.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMReference.java Fri Nov 1 15:25:17 2013
@@ -494,6 +494,9 @@ public final class DOMReference extends
} else {
throw new XMLSignatureException("unrecognized Data type");
}
+
+ boolean secVal = Utils.secureValidation(context);
+ xi.setSecureValidation(secVal);
if (context instanceof XMLSignContext && c14n11
&& !xi.isOctetStream() && !xi.isOutputStreamSet()) {
TransformService spi = null;
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMRetrievalMethod.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMRetrievalMethod.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMRetrievalMethod.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMRetrievalMethod.java Fri Nov 1 15:25:17 2013
@@ -235,8 +235,9 @@ public final class DOMRetrievalMethod ex
{
try {
ApacheData data = (ApacheData)dereference(context);
+ boolean secVal = Utils.secureValidation(context);
DocumentBuilder db =
- org.apache.xml.security.utils.XMLUtils.createDocumentBuilder(false);
+ org.apache.xml.security.utils.XMLUtils.createDocumentBuilder(false, secVal);
Document doc = db.parse(new ByteArrayInputStream
(data.getXMLSignatureInput().getBytes()));
Element kiElem = doc.getDocumentElement();
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMURIDereferencer.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMURIDereferencer.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMURIDereferencer.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMURIDereferencer.java Fri Nov 1 15:25:17 2013
@@ -90,6 +90,7 @@ public class DOMURIDereferencer implemen
}
XMLSignatureInput result = new XMLSignatureInput(referencedElem);
+ result.setSecureValidation(secVal);
if (!uri.substring(1).startsWith("xpointer(id(")) {
result.setExcludeComments(true);
}
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/c14n/Canonicalizer.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/c14n/Canonicalizer.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/c14n/Canonicalizer.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/c14n/Canonicalizer.java Fri Nov 1 15:25:17 2013
@@ -98,6 +98,7 @@ public class Canonicalizer {
new ConcurrentHashMap<String, Class<? extends CanonicalizerSpi>>();
private final CanonicalizerSpi canonicalizerSpi;
+ private boolean secureValidation;
/**
* Constructor Canonicalizer
@@ -248,7 +249,7 @@ public class Canonicalizer {
InputSource in = new InputSource(bais);
// needs to validate for ID attribute normalization
- DocumentBuilder db = XMLUtils.createDocumentBuilder(true);
+ DocumentBuilder db = XMLUtils.createDocumentBuilder(true, secureValidation);
/*
* for some of the test vectors from the specification,
@@ -286,6 +287,7 @@ public class Canonicalizer {
* @throws CanonicalizationException
*/
public byte[] canonicalizeSubtree(Node node) throws CanonicalizationException {
+ canonicalizerSpi.secureValidation = secureValidation;
return canonicalizerSpi.engineCanonicalizeSubTree(node);
}
@@ -299,6 +301,7 @@ public class Canonicalizer {
*/
public byte[] canonicalizeSubtree(Node node, String inclusiveNamespaces)
throws CanonicalizationException {
+ canonicalizerSpi.secureValidation = secureValidation;
return canonicalizerSpi.engineCanonicalizeSubTree(node, inclusiveNamespaces);
}
@@ -312,6 +315,7 @@ public class Canonicalizer {
*/
public byte[] canonicalizeXPathNodeSet(NodeList xpathNodeSet)
throws CanonicalizationException {
+ canonicalizerSpi.secureValidation = secureValidation;
return canonicalizerSpi.engineCanonicalizeXPathNodeSet(xpathNodeSet);
}
@@ -327,6 +331,7 @@ public class Canonicalizer {
public byte[] canonicalizeXPathNodeSet(
NodeList xpathNodeSet, String inclusiveNamespaces
) throws CanonicalizationException {
+ canonicalizerSpi.secureValidation = secureValidation;
return
canonicalizerSpi.engineCanonicalizeXPathNodeSet(xpathNodeSet, inclusiveNamespaces);
}
@@ -340,6 +345,7 @@ public class Canonicalizer {
*/
public byte[] canonicalizeXPathNodeSet(Set<Node> xpathNodeSet)
throws CanonicalizationException {
+ canonicalizerSpi.secureValidation = secureValidation;
return canonicalizerSpi.engineCanonicalizeXPathNodeSet(xpathNodeSet);
}
@@ -354,6 +360,7 @@ public class Canonicalizer {
public byte[] canonicalizeXPathNodeSet(
Set<Node> xpathNodeSet, String inclusiveNamespaces
) throws CanonicalizationException {
+ canonicalizerSpi.secureValidation = secureValidation;
return
canonicalizerSpi.engineCanonicalizeXPathNodeSet(xpathNodeSet, inclusiveNamespaces);
}
@@ -382,5 +389,13 @@ public class Canonicalizer {
public void notReset() {
canonicalizerSpi.reset = false;
}
+
+ public boolean isSecureValidation() {
+ return secureValidation;
+ }
+
+ public void setSecureValidation(boolean secureValidation) {
+ this.secureValidation = secureValidation;
+ }
}
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/c14n/CanonicalizerSpi.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/c14n/CanonicalizerSpi.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/c14n/CanonicalizerSpi.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/c14n/CanonicalizerSpi.java Fri Nov 1 15:25:17 2013
@@ -39,6 +39,7 @@ public abstract class CanonicalizerSpi {
/** Reset the writer after a c14n */
protected boolean reset = false;
+ protected boolean secureValidation;
/**
* Method canonicalize
@@ -58,7 +59,7 @@ public abstract class CanonicalizerSpi {
java.io.InputStream bais = new ByteArrayInputStream(inputBytes);
InputSource in = new InputSource(bais);
- DocumentBuilder db = XMLUtils.createDocumentBuilder(false);
+ DocumentBuilder db = XMLUtils.createDocumentBuilder(false, secureValidation);
Document document = db.parse(in);
return this.engineCanonicalizeSubTree(document);
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/AbstractSerializer.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/AbstractSerializer.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/AbstractSerializer.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/AbstractSerializer.java Fri Nov 1 15:25:17 2013
@@ -39,6 +39,7 @@ import org.w3c.dom.NodeList;
public abstract class AbstractSerializer implements Serializer {
protected Canonicalizer canon;
+ protected boolean secureValidation;
public void setCanonicalizer(Canonicalizer canon) {
this.canon = canon;
@@ -98,6 +99,7 @@ public abstract class AbstractSerializer
@Deprecated
public String serialize(NodeList content) throws Exception {
ByteArrayOutputStream baos = new ByteArrayOutputStream();
+ canon.setSecureValidation(secureValidation);
canon.setWriter(baos);
canon.notReset();
for (int i = 0; i < content.getLength(); i++) {
@@ -119,6 +121,7 @@ public abstract class AbstractSerializer
*/
public byte[] serializeToByteArray(NodeList content) throws Exception {
ByteArrayOutputStream baos = new ByteArrayOutputStream();
+ canon.setSecureValidation(secureValidation);
canon.setWriter(baos);
canon.notReset();
for (int i = 0; i < content.getLength(); i++) {
@@ -136,6 +139,7 @@ public abstract class AbstractSerializer
@Deprecated
public String canonSerialize(Node node) throws Exception {
ByteArrayOutputStream baos = new ByteArrayOutputStream();
+ canon.setSecureValidation(secureValidation);
canon.setWriter(baos);
canon.notReset();
canon.canonicalizeSubtree(node);
@@ -152,6 +156,7 @@ public abstract class AbstractSerializer
*/
public byte[] canonSerializeToByteArray(Node node) throws Exception {
ByteArrayOutputStream baos = new ByteArrayOutputStream();
+ canon.setSecureValidation(secureValidation);
canon.setWriter(baos);
canon.notReset();
canon.canonicalizeSubtree(node);
@@ -245,5 +250,13 @@ public abstract class AbstractSerializer
sb.append(">" + source + "</dummy>");
return sb.toString();
}
+
+ public boolean isSecureValidation() {
+ return secureValidation;
+ }
+
+ public void setSecureValidation(boolean secureValidation) {
+ this.secureValidation = secureValidation;
+ }
}
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/DocumentSerializer.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/DocumentSerializer.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/DocumentSerializer.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/DocumentSerializer.java Fri Nov 1 15:25:17 2013
@@ -69,7 +69,7 @@ public class DocumentSerializer extends
*/
private Node deserialize(Node ctx, InputSource inputSource) throws XMLEncryptionException {
try {
- DocumentBuilder db = XMLUtils.createDocumentBuilder(false);
+ DocumentBuilder db = XMLUtils.createDocumentBuilder(false, secureValidation);
Document d = db.parse(inputSource);
Document contextDocument = null;
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/XMLCipher.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/XMLCipher.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/XMLCipher.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/encryption/XMLCipher.java Fri Nov 1 15:25:17 2013
@@ -1092,6 +1092,9 @@ public class XMLCipher {
if (algorithm == null) {
throw new XMLEncryptionException("XMLCipher instance without transformation specified");
}
+ if (serializer instanceof AbstractSerializer) {
+ ((AbstractSerializer)serializer).setSecureValidation(secureValidation);
+ }
byte[] serializedOctets = null;
if (serializedData == null) {
@@ -1604,6 +1607,9 @@ public class XMLCipher {
if (log.isDebugEnabled()) {
log.debug("Decrypting element...");
}
+ if (serializer instanceof AbstractSerializer) {
+ ((AbstractSerializer)serializer).setSecureValidation(secureValidation);
+ }
if (cipherMode != DECRYPT_MODE) {
log.error("XMLCipher unexpectedly not in DECRYPT_MODE...");
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/KeyInfoReferenceResolver.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/KeyInfoReferenceResolver.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/KeyInfoReferenceResolver.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/KeyInfoReferenceResolver.java Fri Nov 1 15:25:17 2013
@@ -266,7 +266,7 @@ public class KeyInfoReferenceResolver ex
*/
private Element getDocFromBytes(byte[] bytes) throws KeyResolverException {
try {
- DocumentBuilder db = XMLUtils.createDocumentBuilder(false);
+ DocumentBuilder db = XMLUtils.createDocumentBuilder(false, secureValidation);
Document doc = db.parse(new ByteArrayInputStream(bytes));
return doc.getDocumentElement();
} catch (SAXException ex) {
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/RetrievalMethodResolver.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/RetrievalMethodResolver.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/RetrievalMethodResolver.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/RetrievalMethodResolver.java Fri Nov 1 15:25:17 2013
@@ -96,7 +96,7 @@ public class RetrievalMethodResolver ext
}
return null;
}
- Element e = obtainReferenceElement(resource);
+ Element e = obtainReferenceElement(resource, secureValidation);
// Check to make sure that the reference is not to another RetrievalMethod
// which points to this element
@@ -111,7 +111,7 @@ public class RetrievalMethodResolver ext
}
RetrievalMethod rm2 = new RetrievalMethod(e, baseURI);
XMLSignatureInput resource2 = resolveInput(rm2, baseURI, secureValidation);
- Element e2 = obtainReferenceElement(resource2);
+ Element e2 = obtainReferenceElement(resource2, secureValidation);
if (e2 == element) {
if (log.isDebugEnabled()) {
log.debug("Error: Can't have RetrievalMethods pointing to each other");
@@ -166,7 +166,7 @@ public class RetrievalMethodResolver ext
return getRawCertificate(resource);
}
- Element e = obtainReferenceElement(resource);
+ Element e = obtainReferenceElement(resource, secureValidation);
// Check to make sure that the reference is not to another RetrievalMethod
// which points to this element
@@ -181,7 +181,7 @@ public class RetrievalMethodResolver ext
}
RetrievalMethod rm2 = new RetrievalMethod(e, baseURI);
XMLSignatureInput resource2 = resolveInput(rm2, baseURI, secureValidation);
- Element e2 = obtainReferenceElement(resource2);
+ Element e2 = obtainReferenceElement(resource2, secureValidation);
if (e2 == element) {
if (log.isDebugEnabled()) {
log.debug("Error: Can't have RetrievalMethods pointing to each other");
@@ -259,7 +259,7 @@ public class RetrievalMethodResolver ext
return null;
}
- private static Element obtainReferenceElement(XMLSignatureInput resource)
+ private static Element obtainReferenceElement(XMLSignatureInput resource, boolean secureValidation)
throws CanonicalizationException, ParserConfigurationException,
IOException, SAXException, KeyResolverException {
Element e;
@@ -271,7 +271,7 @@ public class RetrievalMethodResolver ext
} else {
// Retrieved resource is an inputStream
byte inputBytes[] = resource.getBytes();
- e = getDocFromBytes(inputBytes);
+ e = getDocFromBytes(inputBytes, secureValidation);
// otherwise, we parse the resource, create an Element and delegate
if (log.isDebugEnabled()) {
log.debug("we have to parse " + inputBytes.length + " bytes");
@@ -320,9 +320,9 @@ public class RetrievalMethodResolver ext
* @return the Document Element after parsing bytes
* @throws KeyResolverException if something goes wrong
*/
- private static Element getDocFromBytes(byte[] bytes) throws KeyResolverException {
+ private static Element getDocFromBytes(byte[] bytes, boolean secureValidation) throws KeyResolverException {
try {
- DocumentBuilder db = XMLUtils.createDocumentBuilder(false);
+ DocumentBuilder db = XMLUtils.createDocumentBuilder(false, secureValidation);
Document doc = db.parse(new ByteArrayInputStream(bytes));
return doc.getDocumentElement();
} catch (SAXException ex) {
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/Manifest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/Manifest.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/Manifest.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/Manifest.java Fri Nov 1 15:25:17 2013
@@ -602,4 +602,8 @@ public class Manifest extends SignatureE
public String getBaseLocalName() {
return Constants._TAG_MANIFEST;
}
+
+ public boolean isSecureValidation() {
+ return secureValidation;
+ }
}
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/SignedInfo.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/SignedInfo.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/SignedInfo.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/SignedInfo.java Fri Nov 1 15:25:17 2013
@@ -177,7 +177,7 @@ public class SignedInfo extends Manifest
Element element, String baseURI, boolean secureValidation
) throws XMLSecurityException {
// Parse the Reference children and Id attribute in the Manifest
- super(reparseSignedInfoElem(element), baseURI, secureValidation);
+ super(reparseSignedInfoElem(element, secureValidation), baseURI, secureValidation);
c14nMethod = XMLUtils.getNextElement(element.getFirstChild());
signatureMethod = XMLUtils.getNextElement(c14nMethod.getNextSibling());
@@ -185,7 +185,7 @@ public class SignedInfo extends Manifest
new SignatureAlgorithm(signatureMethod, this.getBaseURI(), secureValidation);
}
- private static Element reparseSignedInfoElem(Element element)
+ private static Element reparseSignedInfoElem(Element element, boolean secureValidation)
throws XMLSecurityException {
/*
* If a custom canonicalizationMethod is used, canonicalize
@@ -207,9 +207,11 @@ public class SignedInfo extends Manifest
try {
Canonicalizer c14nizer =
Canonicalizer.getInstance(c14nMethodURI);
+ c14nizer.setSecureValidation(secureValidation);
byte[] c14nizedBytes = c14nizer.canonicalizeSubtree(element);
- javax.xml.parsers.DocumentBuilder db = XMLUtils.createDocumentBuilder(false);
+ javax.xml.parsers.DocumentBuilder db =
+ XMLUtils.createDocumentBuilder(false, secureValidation);
Document newdoc =
db.parse(new ByteArrayInputStream(c14nizedBytes));
Node imported =
@@ -267,6 +269,7 @@ public class SignedInfo extends Manifest
if (this.c14nizedBytes == null) {
Canonicalizer c14nizer =
Canonicalizer.getInstance(this.getCanonicalizationMethodURI());
+ c14nizer.setSecureValidation(isSecureValidation());
this.c14nizedBytes =
c14nizer.canonicalizeSubtree(this.constructionElement);
@@ -288,6 +291,7 @@ public class SignedInfo extends Manifest
if (this.c14nizedBytes == null) {
Canonicalizer c14nizer =
Canonicalizer.getInstance(this.getCanonicalizationMethodURI());
+ c14nizer.setSecureValidation(isSecureValidation());
c14nizer.setWriter(os);
String inclusiveNamespaces = this.getInclusiveNamespaces();
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/XMLSignatureInput.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/XMLSignatureInput.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/XMLSignatureInput.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/signature/XMLSignatureInput.java Fri Nov 1 15:25:17 2013
@@ -85,6 +85,7 @@ public class XMLSignatureInput {
* A cached bytes
*/
private byte[] bytes = null;
+ private boolean secureValidation;
/**
* Some Transforms may require explicit MIME type, charset (IANA registered
@@ -548,7 +549,7 @@ public class XMLSignatureInput {
void convertToNodes() throws CanonicalizationException,
ParserConfigurationException, IOException, SAXException {
- DocumentBuilder db = XMLUtils.createDocumentBuilder(false);
+ DocumentBuilder db = XMLUtils.createDocumentBuilder(false, secureValidation);
// select all nodes, also the comments.
try {
db.setErrorHandler(new org.apache.xml.security.utils.IgnoreAllErrorHandler());
@@ -574,5 +575,13 @@ public class XMLSignatureInput {
this.bytes = null;
}
}
+
+ public boolean isSecureValidation() {
+ return secureValidation;
+ }
+
+ public void setSecureValidation(boolean secureValidation) {
+ this.secureValidation = secureValidation;
+ }
}
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/Transform.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/Transform.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/Transform.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/Transform.java Fri Nov 1 15:25:17 2013
@@ -74,6 +74,7 @@ public final class Transform extends Sig
new ConcurrentHashMap<String, Class<? extends TransformSpi>>();
private final TransformSpi transformSpi;
+ private boolean secureValidation;
/**
* Generates a Transform object that implements the specified
@@ -301,6 +302,7 @@ public final class Transform extends Sig
XMLSignatureInput result = null;
try {
+ transformSpi.secureValidation = secureValidation;
result = transformSpi.enginePerformTransform(input, os, this);
} catch (ParserConfigurationException ex) {
Object exArgs[] = { this.getURI(), "ParserConfigurationException" };
@@ -363,4 +365,12 @@ public final class Transform extends Sig
return newTransformSpi;
}
+ public boolean isSecureValidation() {
+ return secureValidation;
+ }
+
+ public void setSecureValidation(boolean secureValidation) {
+ this.secureValidation = secureValidation;
+ }
+
}
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/TransformSpi.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/TransformSpi.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/TransformSpi.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/TransformSpi.java Fri Nov 1 15:25:17 2013
@@ -36,6 +36,8 @@ import org.xml.sax.SAXException;
*/
public abstract class TransformSpi {
+ protected boolean secureValidation;
+
/**
* The mega method which MUST be implemented by the Transformation Algorithm.
*
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/Transforms.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/Transforms.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/Transforms.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/Transforms.java Fri Nov 1 15:25:17 2013
@@ -296,6 +296,7 @@ public class Transforms extends Signatur
"signature.Transform.ForbiddenTransform", exArgs
);
}
+ transform.setSecureValidation(secureValidation);
}
/**
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformBase64Decode.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformBase64Decode.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformBase64Decode.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformBase64Decode.java Fri Nov 1 15:25:17 2013
@@ -109,10 +109,13 @@ public class TransformBase64Decode exten
traverseElement((Element)el, sb);
if (os == null) {
byte[] decodedBytes = Base64.decode(sb.toString());
- return new XMLSignatureInput(decodedBytes);
+ XMLSignatureInput output = new XMLSignatureInput(decodedBytes);
+ output.setSecureValidation(secureValidation);
+ return output;
}
Base64.decode(sb.toString(), os);
XMLSignatureInput output = new XMLSignatureInput((byte[])null);
+ output.setSecureValidation(secureValidation);
output.setOutputStream(os);
return output;
}
@@ -121,7 +124,9 @@ public class TransformBase64Decode exten
if (os == null) {
byte[] base64Bytes = input.getBytes();
byte[] decodedBytes = Base64.decode(base64Bytes);
- return new XMLSignatureInput(decodedBytes);
+ XMLSignatureInput output = new XMLSignatureInput(decodedBytes);
+ output.setSecureValidation(secureValidation);
+ return output;
}
if (input.isByteArray() || input.isNodeSet()) {
Base64.decode(input.getBytes(), os);
@@ -129,6 +134,7 @@ public class TransformBase64Decode exten
Base64.decode(new BufferedInputStream(input.getOctetStreamReal()), os);
}
XMLSignatureInput output = new XMLSignatureInput((byte[])null);
+ output.setSecureValidation(secureValidation);
output.setOutputStream(os);
return output;
}
@@ -136,13 +142,16 @@ public class TransformBase64Decode exten
try {
//Exceptional case there is current not text case testing this(Before it was a
//a common case).
- Document doc = XMLUtils.createDocumentBuilder(false).parse(input.getOctetStream());
+ Document doc =
+ XMLUtils.createDocumentBuilder(false, secureValidation).parse(input.getOctetStream());
Element rootNode = doc.getDocumentElement();
StringBuilder sb = new StringBuilder();
traverseElement(rootNode, sb);
byte[] decodedBytes = Base64.decode(sb.toString());
- return new XMLSignatureInput(decodedBytes);
+ XMLSignatureInput output = new XMLSignatureInput(decodedBytes);
+ output.setSecureValidation(secureValidation);
+ return output;
} catch (ParserConfigurationException e) {
throw new TransformationException("c14n.Canonicalizer.Exception",e);
} catch (SAXException e) {
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N.java Fri Nov 1 15:25:17 2013
@@ -56,6 +56,7 @@ public class TransformC14N extends Trans
byte[] result = null;
result = c14n.engineCanonicalize(input);
XMLSignatureInput output = new XMLSignatureInput(result);
+ output.setSecureValidation(secureValidation);
if (os != null) {
output.setOutputStream(os);
}
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N11.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N11.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N11.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N11.java Fri Nov 1 15:25:17 2013
@@ -49,6 +49,7 @@ public class TransformC14N11 extends Tra
byte[] result = null;
result = c14n.engineCanonicalize(input);
XMLSignatureInput output = new XMLSignatureInput(result);
+ output.setSecureValidation(secureValidation);
if (os != null) {
output.setOutputStream(os);
}
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N11_WithComments.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N11_WithComments.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N11_WithComments.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14N11_WithComments.java Fri Nov 1 15:25:17 2013
@@ -50,7 +50,8 @@ public class TransformC14N11_WithComment
byte[] result = null;
result = c14n.engineCanonicalize(input);
- XMLSignatureInput output = new XMLSignatureInput(result);
+ XMLSignatureInput output = new XMLSignatureInput(result);
+ output.setSecureValidation(secureValidation);
if (os != null) {
output.setOutputStream(os);
}
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NExclusive.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NExclusive.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NExclusive.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NExclusive.java Fri Nov 1 15:25:17 2013
@@ -81,6 +81,7 @@ public class TransformC14NExclusive exte
byte[] result = c14n.engineCanonicalize(input, inclusiveNamespaces);
XMLSignatureInput output = new XMLSignatureInput(result);
+ output.setSecureValidation(secureValidation);
if (os != null) {
output.setOutputStream(os);
}
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NExclusiveWithComments.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NExclusiveWithComments.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NExclusiveWithComments.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NExclusiveWithComments.java Fri Nov 1 15:25:17 2013
@@ -83,6 +83,7 @@ public class TransformC14NExclusiveWithC
}
byte[] result = c14n.engineCanonicalize(input, inclusiveNamespaces);
XMLSignatureInput output = new XMLSignatureInput(result);
+ output.setSecureValidation(secureValidation);
return output;
} catch (XMLSecurityException ex) {
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NWithComments.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NWithComments.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NWithComments.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformC14NWithComments.java Fri Nov 1 15:25:17 2013
@@ -56,7 +56,8 @@ public class TransformC14NWithComments e
byte[] result = null;
result = c14n.engineCanonicalize(input);
- XMLSignatureInput output = new XMLSignatureInput(result);
+ XMLSignatureInput output = new XMLSignatureInput(result);
+ output.setSecureValidation(secureValidation);
if (os != null) {
output.setOutputStream(os);
}
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformXSLT.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformXSLT.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformXSLT.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/transforms/implementations/TransformXSLT.java Fri Nov 1 15:25:17 2013
@@ -138,12 +138,15 @@ public class TransformXSLT extends Trans
ByteArrayOutputStream baos1 = new ByteArrayOutputStream();
StreamResult outputTarget = new StreamResult(baos1);
transformer.transform(xmlSource, outputTarget);
- return new XMLSignatureInput(baos1.toByteArray());
+ XMLSignatureInput output = new XMLSignatureInput(baos1.toByteArray());
+ output.setSecureValidation(secureValidation);
+ return output;
}
StreamResult outputTarget = new StreamResult(baos);
transformer.transform(xmlSource, outputTarget);
XMLSignatureInput output = new XMLSignatureInput((byte[])null);
+ output.setSecureValidation(secureValidation);
output.setOutputStream(baos);
return output;
} catch (XMLSecurityException ex) {
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/XMLUtils.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/XMLUtils.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/XMLUtils.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/XMLUtils.java Fri Nov 1 15:25:17 2013
@@ -1027,8 +1027,17 @@ public class XMLUtils {
}
public static DocumentBuilder createDocumentBuilder(boolean validating) throws ParserConfigurationException {
+ return createDocumentBuilder(validating, true);
+ }
+
+ public static DocumentBuilder createDocumentBuilder(
+ boolean validating, boolean disAllowDocTypeDeclarations
+ ) throws ParserConfigurationException {
DocumentBuilderFactory dfactory = DocumentBuilderFactory.newInstance();
dfactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ if (disAllowDocTypeDeclarations) {
+ dfactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+ }
dfactory.setValidating(validating);
dfactory.setNamespaceAware(true);
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverAnonymous.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverAnonymous.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverAnonymous.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverAnonymous.java Fri Nov 1 15:25:17 2013
@@ -59,7 +59,9 @@ public class ResolverAnonymous extends R
/** @inheritDoc */
@Override
public XMLSignatureInput engineResolveURI(ResourceResolverContext context) {
- return new XMLSignatureInput(inStream);
+ XMLSignatureInput input = new XMLSignatureInput(inStream);
+ input.setSecureValidation(context.secureValidation);
+ return input;
}
/**
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverDirectHTTP.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverDirectHTTP.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverDirectHTTP.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverDirectHTTP.java Fri Nov 1 15:25:17 2013
@@ -151,6 +151,7 @@ public class ResolverDirectHTTP extends
}
XMLSignatureInput result = new XMLSignatureInput(baos.toByteArray());
+ result.setSecureValidation(context.secureValidation);
result.setSourceURI(uriNew.toString());
result.setMIMEType(mimeType);
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverFragment.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverFragment.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverFragment.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverFragment.java Fri Nov 1 15:25:17 2013
@@ -103,6 +103,7 @@ public class ResolverFragment extends Re
}
XMLSignatureInput result = new XMLSignatureInput(selectedElem);
+ result.setSecureValidation(context.secureValidation);
result.setExcludeComments(true);
result.setMIMEType("text/xml");
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverLocalFilesystem.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverLocalFilesystem.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverLocalFilesystem.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverLocalFilesystem.java Fri Nov 1 15:25:17 2013
@@ -57,6 +57,7 @@ public class ResolverLocalFilesystem ext
ResolverLocalFilesystem.translateUriToFilename(uriNew.toString());
FileInputStream inputStream = new FileInputStream(fileName);
XMLSignatureInput result = new XMLSignatureInput(inputStream);
+ result.setSecureValidation(context.secureValidation);
result.setSourceURI(uriNew.toString());
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverXPointer.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverXPointer.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverXPointer.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverXPointer.java Fri Nov 1 15:25:17 2013
@@ -92,6 +92,7 @@ public class ResolverXPointer extends Re
}
XMLSignatureInput result = new XMLSignatureInput(resultNode);
+ result.setSecureValidation(context.secureValidation);
result.setMIMEType("text/xml");
if (context.baseUri != null && context.baseUri.length() > 0) {
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/JSRWrappingAttackTest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/JSRWrappingAttackTest.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/JSRWrappingAttackTest.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/JSRWrappingAttackTest.java Fri Nov 1 15:25:17 2013
@@ -56,7 +56,7 @@ public class JSRWrappingAttackTest exten
public void testWrappingAttack() throws Exception {
String file = "manifestSignatureWrapping.xml";
- Document doc = XMLUtils.createDocumentBuilder(false).parse(new File(dir, file));
+ Document doc = XMLUtils.createDocumentBuilder(false, false).parse(new File(dir, file));
Element sigElement = SignatureValidator.getSignatureElement(doc);
if (sigElement == null) {
throw new Exception("Couldn't find signature Element");
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/SignatureValidator.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/SignatureValidator.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/SignatureValidator.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/SignatureValidator.java Fri Nov 1 15:25:17 2013
@@ -54,7 +54,7 @@ public class SignatureValidator {
public DOMValidateContext getValidateContext(String fn, KeySelector ks)
throws Exception {
- Document doc = XMLUtils.createDocumentBuilder(false).parse(new File(dir, fn));
+ Document doc = XMLUtils.createDocumentBuilder(false, false).parse(new File(dir, fn));
Element sigElement = getSignatureElement(doc);
if (sigElement == null) {
throw new Exception("Couldn't find signature Element");
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/TestUtils.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/TestUtils.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/TestUtils.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/TestUtils.java Fri Nov 1 15:25:17 2013
@@ -129,7 +129,7 @@ public class TestUtils {
String tag)
throws Exception {
if (type.equalsIgnoreCase("dom")) {
- DocumentBuilder docBuilder = XMLUtils.createDocumentBuilder(false);
+ DocumentBuilder docBuilder = XMLUtils.createDocumentBuilder(false, false);
Document doc = docBuilder.parse(input);
if (tag == null) {
return new DOMValidateContext
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/XMLSignatureFactoryTest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/XMLSignatureFactoryTest.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/XMLSignatureFactoryTest.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/javax/xml/crypto/test/dsig/XMLSignatureFactoryTest.java Fri Nov 1 15:25:17 2013
@@ -153,7 +153,7 @@ public class XMLSignatureFactoryTest ext
" for wrong inputs");
}
- DocumentBuilder docBuilder = XMLUtils.createDocumentBuilder(false);
+ DocumentBuilder docBuilder = XMLUtils.createDocumentBuilder(false, false);
String fs = System.getProperty("file.separator");
String base = System.getProperty("basedir") == null ? "./": System.getProperty("basedir");
File dir = new File(base + fs +
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/Canonicalizer11Test.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/Canonicalizer11Test.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/Canonicalizer11Test.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/Canonicalizer11Test.java Fri Nov 1 15:25:17 2013
@@ -356,7 +356,7 @@ public class Canonicalizer11Test extends
ParserConfigurationException, CanonicalizationException,
InvalidCanonicalizerException, TransformerException, XPathExpressionException {
- DocumentBuilder documentBuilder = XMLUtils.createDocumentBuilder(validating);
+ DocumentBuilder documentBuilder = XMLUtils.createDocumentBuilder(validating, false);
// throw away all warnings and errors
documentBuilder.setErrorHandler(new IgnoreAllErrorHandler());
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/Canonicalizer20010315Test.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/Canonicalizer20010315Test.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/Canonicalizer20010315Test.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/Canonicalizer20010315Test.java Fri Nov 1 15:25:17 2013
@@ -609,7 +609,7 @@ public class Canonicalizer20010315Test e
//String c14nURI = Canonicalizer.ALGO_ID_C14N_OMIT_COMMENTS;
//boolean validating = true;
- DocumentBuilder db = XMLUtils.createDocumentBuilder(false);
+ DocumentBuilder db = XMLUtils.createDocumentBuilder(false, false);
org.xml.sax.EntityResolver resolver = new TestVectorResolver();
db.setEntityResolver(resolver);
@@ -1038,7 +1038,7 @@ public class Canonicalizer20010315Test e
ParserConfigurationException, CanonicalizationException,
InvalidCanonicalizerException, TransformerException, XPathExpressionException {
- DocumentBuilder documentBuilder = XMLUtils.createDocumentBuilder(validating);
+ DocumentBuilder documentBuilder = XMLUtils.createDocumentBuilder(validating, false);
// throw away all warnings and errors
documentBuilder.setErrorHandler(new IgnoreAllErrorHandler());
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/ExclusiveC14NInteropTest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/ExclusiveC14NInteropTest.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/ExclusiveC14NInteropTest.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/c14n/implementations/ExclusiveC14NInteropTest.java Fri Nov 1 15:25:17 2013
@@ -126,7 +126,7 @@ public class ExclusiveC14NInteropTest ex
File f = new File(directory + "/" + file);
- javax.xml.parsers.DocumentBuilder db = XMLUtils.createDocumentBuilder(false);
+ javax.xml.parsers.DocumentBuilder db = XMLUtils.createDocumentBuilder(false, false);
org.w3c.dom.Document doc = db.parse(f);
Element sigElement =
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/interop/InteropTestBase.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/interop/InteropTestBase.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/interop/InteropTestBase.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/interop/InteropTestBase.java Fri Nov 1 15:25:17 2013
@@ -59,7 +59,7 @@ public class InteropTestBase extends org
String filename, ResourceResolverSpi resolver, boolean followManifests, byte[] hmacKey
) throws Exception {
File f = new File(filename);
- javax.xml.parsers.DocumentBuilder db = XMLUtils.createDocumentBuilder(false);
+ javax.xml.parsers.DocumentBuilder db = XMLUtils.createDocumentBuilder(false, false);
org.w3c.dom.Document doc = db.parse(new java.io.FileInputStream(f));
XPathFactory xpf = XPathFactory.newInstance();
@@ -93,7 +93,7 @@ public class InteropTestBase extends org
public boolean verify(String filename, ResourceResolverSpi resolver, boolean followManifests)
throws Exception {
File f = new File(filename);
- javax.xml.parsers.DocumentBuilder db = XMLUtils.createDocumentBuilder(false);
+ javax.xml.parsers.DocumentBuilder db = XMLUtils.createDocumentBuilder(false, false);
org.w3c.dom.Document doc = db.parse(f);
XPathFactory xpf = XPathFactory.newInstance();
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenAlgorithmTest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenAlgorithmTest.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenAlgorithmTest.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenAlgorithmTest.java Fri Nov 1 15:25:17 2013
@@ -70,7 +70,7 @@ public class ForbiddenAlgorithmTest exte
File f = new File(directory + "/" + file);
- javax.xml.parsers.DocumentBuilder db = XMLUtils.createDocumentBuilder(false);
+ javax.xml.parsers.DocumentBuilder db = XMLUtils.createDocumentBuilder(false, false);
org.w3c.dom.Document doc = db.parse(f);
Element sigElement =
Modified: santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/secure_val/WrappingAttackTest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/secure_val/WrappingAttackTest.java?rev=1537956&r1=1537955&r2=1537956&view=diff
==============================================================================
--- santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/secure_val/WrappingAttackTest.java (original)
+++ santuario/xml-security-java/branches/1.5.x-fixes/src/test/java/org/apache/xml/security/test/secure_val/WrappingAttackTest.java Fri Nov 1 15:25:17 2013
@@ -75,7 +75,7 @@ public class WrappingAttackTest extends
File f = new File(directory + "/" + file);
- javax.xml.parsers.DocumentBuilder db = XMLUtils.createDocumentBuilder(false);
+ javax.xml.parsers.DocumentBuilder db = XMLUtils.createDocumentBuilder(false, false);
org.w3c.dom.Document doc = db.parse(f);
Element sigElement =
@@ -95,7 +95,7 @@ public class WrappingAttackTest extends
File f = new File(directory + "/" + file);
- javax.xml.parsers.DocumentBuilder db = XMLUtils.createDocumentBuilder(false);
+ javax.xml.parsers.DocumentBuilder db = XMLUtils.createDocumentBuilder(false, false);
org.w3c.dom.Document doc = db.parse(f);
Element sigElement =