You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@santuario.apache.org by co...@apache.org on 2018/12/19 10:51:08 UTC
svn commit: r1849290 - in
/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor:
input/AbstractDecryptInputProcessor.java
input/AbstractSignatureInputHandler.java
output/AbstractSignatureEndingOutputProcessor.java
Author: coheigea
Date: Wed Dec 19 10:51:08 2018
New Revision: 1849290
URL: http://svn.apache.org/viewvc?rev=1849290&view=rev
Log:
Destroy a few more secret keys
Modified:
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/input/AbstractDecryptInputProcessor.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/input/AbstractSignatureInputHandler.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/output/AbstractSignatureEndingOutputProcessor.java
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/input/AbstractDecryptInputProcessor.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/input/AbstractDecryptInputProcessor.java?rev=1849290&r1=1849289&r2=1849290&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/input/AbstractDecryptInputProcessor.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/input/AbstractDecryptInputProcessor.java Wed Dec 19 10:51:08 2018
@@ -44,6 +44,8 @@ import org.apache.xml.security.stax.secu
import org.apache.xml.security.stax.impl.util.*;
import javax.crypto.*;
+import javax.security.auth.DestroyFailedException;
+import javax.security.auth.Destroyable;
import javax.xml.bind.JAXBElement;
import javax.xml.bind.JAXBException;
import javax.xml.bind.Unmarshaller;
@@ -862,6 +864,16 @@ public abstract class AbstractDecryptInp
//close to get Cipher.doFinal() called
outputStreamWriter.close();
+
+ // Clean the secret key from memory now that we're done with it
+ if (secretKey instanceof Destroyable) {
+ try {
+ ((Destroyable)secretKey).destroy();
+ } catch (DestroyFailedException e) {
+ LOG.debug("Error destroying key: {}", e.getMessage());
+ }
+ }
+
LOG.debug("Decryption thread finished");
} catch (Exception e) {
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/input/AbstractSignatureInputHandler.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/input/AbstractSignatureInputHandler.java?rev=1849290&r1=1849289&r2=1849290&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/input/AbstractSignatureInputHandler.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/input/AbstractSignatureInputHandler.java Wed Dec 19 10:51:08 2018
@@ -29,12 +29,16 @@ import org.apache.xml.security.stax.secu
import org.apache.xml.security.utils.UnsyncBufferedOutputStream;
import org.apache.xml.security.utils.UnsyncByteArrayInputStream;
import org.apache.xml.security.utils.UnsyncByteArrayOutputStream;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
import org.apache.xml.security.stax.ext.stax.XMLSecEvent;
import org.apache.xml.security.stax.ext.stax.XMLSecEventFactory;
import org.apache.xml.security.stax.impl.algorithms.SignatureAlgorithm;
import org.apache.xml.security.stax.impl.algorithms.SignatureAlgorithmFactory;
import org.apache.xml.security.stax.impl.util.*;
+import javax.security.auth.DestroyFailedException;
+import javax.security.auth.Destroyable;
import javax.xml.bind.JAXBElement;
import javax.xml.stream.XMLInputFactory;
import javax.xml.stream.XMLStreamConstants;
@@ -52,6 +56,8 @@ import java.util.*;
*/
public abstract class AbstractSignatureInputHandler extends AbstractInputSecurityHeaderHandler {
+ private static final transient Logger LOG = LoggerFactory.getLogger(AbstractSignatureInputHandler.class);
+
@Override
public void handle(final InputProcessorChain inputProcessorChain, final XMLSecurityProperties securityProperties,
Deque<XMLSecEvent> eventQueue, Integer index) throws XMLSecurityException {
@@ -335,6 +341,15 @@ public abstract class AbstractSignatureI
} catch (NoSuchProviderException e) {
throw new XMLSecurityException(e);
}
+
+ // Clean the secret key from memory now that we're done with it
+ if (verifyKey instanceof Destroyable) {
+ try {
+ ((Destroyable)verifyKey).destroy();
+ } catch (DestroyFailedException e) {
+ LOG.debug("Error destroying key: {}", e.getMessage());
+ }
+ }
}
protected void processEvent(XMLSecEvent xmlSecEvent) throws XMLStreamException {
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/output/AbstractSignatureEndingOutputProcessor.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/output/AbstractSignatureEndingOutputProcessor.java?rev=1849290&r1=1849289&r2=1849290&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/output/AbstractSignatureEndingOutputProcessor.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/stax/impl/processor/output/AbstractSignatureEndingOutputProcessor.java Wed Dec 19 10:51:08 2018
@@ -25,6 +25,8 @@ import java.security.NoSuchAlgorithmExce
import java.security.NoSuchProviderException;
import java.util.*;
+import javax.security.auth.DestroyFailedException;
+import javax.security.auth.Destroyable;
import javax.xml.stream.XMLStreamException;
import org.apache.xml.security.exceptions.XMLSecurityException;
@@ -48,11 +50,15 @@ import org.apache.xml.security.stax.secu
import org.apache.xml.security.stax.securityToken.SecurityTokenProvider;
import org.apache.xml.security.utils.UnsyncBufferedOutputStream;
import org.apache.xml.security.utils.XMLUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
/**
*/
public abstract class AbstractSignatureEndingOutputProcessor extends AbstractBufferingOutputProcessor {
+ private static final transient Logger LOG = LoggerFactory.getLogger(AbstractSignatureEndingOutputProcessor.class);
+
private List<SignaturePartDef> signaturePartDefList;
public AbstractSignatureEndingOutputProcessor(AbstractSignatureOutputProcessor signatureOutputProcessor)
@@ -220,6 +226,15 @@ public abstract class AbstractSignatureE
createEndElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_KeyInfo);
}
createEndElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_Signature);
+
+ // Clean the secret key from memory now that we're done with it
+ if (key instanceof Destroyable) {
+ try {
+ ((Destroyable)key).destroy();
+ } catch (DestroyFailedException e) {
+ LOG.debug("Error destroying key: {}", e.getMessage());
+ }
+ }
}
protected abstract SignedInfoProcessor newSignedInfoProcessor(