You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@santuario.apache.org by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2019/11/07 14:10:00 UTC
[jira] [Resolved] (SANTUARIO-515) XMLSignature does not enforce
structure of the ds:Signature element
[ https://issues.apache.org/jira/browse/SANTUARIO-515?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Colm O hEigeartaigh resolved SANTUARIO-515.
-------------------------------------------
Resolution: Fixed
> XMLSignature does not enforce structure of the ds:Signature element
> -------------------------------------------------------------------
>
> Key: SANTUARIO-515
> URL: https://issues.apache.org/jira/browse/SANTUARIO-515
> Project: Santuario
> Issue Type: Bug
> Components: Java
> Affects Versions: Java 2.1.4
> Reporter: Ian Young
> Assignee: Colm O hEigeartaigh
> Priority: Major
> Fix For: Java 2.2.0, Java 2.1.5
>
>
> Related to SANTUARIO-514, the org.apache.xml.security.signature.XMLSignature's parsing constructor does not enforce the structure of the Signature element.
> Specifically, any elements after the SignedInfo, SignatureValue and KeyInfo elements are _assumed_ to be {{ds:Object}} elements, without checking the element name. Elements other than ds:Object should be rejected.
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)