You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@santuario.apache.org by co...@apache.org on 2011/12/08 12:56:31 UTC
svn commit: r1211847 [1/2] - in /santuario/xml-security-java/trunk:
samples/org/apache/xml/security/samples/
samples/org/apache/xml/security/samples/transforms/
src/main/java/org/apache/jcp/xml/dsig/internal/dom/
src/main/java/org/apache/xml/security/a...
Author: coheigea
Date: Thu Dec 8 11:56:30 2011
New Revision: 1211847
URL: http://svn.apache.org/viewvc?rev=1211847&view=rev
Log:
[SANTUARIO-290] - Add a secure validation switch for signature processing
Added:
santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/JSRForbiddenRefCountTest.java
santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/JSRForbiddenReferenceTest.java
santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/
santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenAlgorithmTest.java
santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenRefCountTest.java
santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenReferenceTest.java
santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/secure_val/ForbiddenRetrievalMethodTest.java
santuario/xml-security-java/trunk/src/test/resources/interop/c14n/Y4/signature-manifest.xml
santuario/xml-security-java/trunk/src/test/resources/org/apache/xml/security/keyresolver/retrievalmethod3.xml
Modified:
santuario/xml-security-java/trunk/samples/org/apache/xml/security/samples/TransformPerformanceTester.java
santuario/xml-security-java/trunk/samples/org/apache/xml/security/samples/transforms/SampleTransformXPathFilterCHGP.java
santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheTransform.java
santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMManifest.java
santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMReference.java
santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMRetrievalMethod.java
santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMSignedInfo.java
santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMURIDereferencer.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/algorithms/SignatureAlgorithm.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/encryption/XMLCipher.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/encryption/XMLCipherInput.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/KeyInfo.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/keyresolver/KeyResolverSpi.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/RetrievalMethodResolver.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/resource/config.xml
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/resource/xmlsecurity_de.properties
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/resource/xmlsecurity_en.properties
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/Manifest.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/Reference.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/SignedInfo.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/XMLSignature.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/Transform.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/Transforms.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/implementations/TransformXPath2Filter.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPath2FilterContainer.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPath2FilterContainer04.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPathFilterCHGPContainer.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/utils/JDKXPathAPI.java
santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/utils/resolver/ResourceResolver.java
santuario/xml-security-java/trunk/src/test/java/javax/xml/crypto/test/dsig/SignatureValidator.java
Modified: santuario/xml-security-java/trunk/samples/org/apache/xml/security/samples/TransformPerformanceTester.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/samples/org/apache/xml/security/samples/TransformPerformanceTester.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/samples/org/apache/xml/security/samples/TransformPerformanceTester.java (original)
+++ santuario/xml-security-java/trunk/samples/org/apache/xml/security/samples/TransformPerformanceTester.java Thu Dec 8 11:56:30 2011
@@ -1257,7 +1257,7 @@ public class TransformPerformanceTester
"");
xpathContainer.setXPathNamespaceContext("ds",
Constants.SignatureSpecNS);
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
xpathContainer.getElement());
}
@@ -1322,7 +1322,7 @@ public class TransformPerformanceTester
xpathContainer.setXPathNamespaceContext("ds",
Constants.SignatureSpecNS);
- transforms.addTransform(Transforms.TRANSFORM_XPATHFILTERCHGP,
+ transforms.addTransform(XPathFilterCHGPContainer.TRANSFORM_XPATHFILTERCHGP,
xpathContainer.getElement());
}
@@ -1403,7 +1403,7 @@ public class TransformPerformanceTester
Transforms transforms = new Transforms(doc);
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceIntersect(doc,
"//ToBeSigned").getElement());
sig.addDocument("", transforms);
@@ -1446,10 +1446,10 @@ public class TransformPerformanceTester
Transforms transforms = new Transforms(doc);
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceIntersect(doc,
"//ToBeSigned").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceSubtract(doc,
"//NotToBeSigned").getElement());
sig.addDocument("", transforms);
@@ -1492,13 +1492,13 @@ public class TransformPerformanceTester
Transforms transforms = new Transforms(doc);
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceIntersect(doc,
"//ToBeSigned").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceSubtract(doc,
"//NotToBeSigned").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//ReallyToBeSigned").getElement());
sig.addDocument("", transforms);
@@ -1552,7 +1552,7 @@ public class TransformPerformanceTester
xpathContainer.setXPathNamespaceContext("ds",
Constants.SignatureSpecNS);
- transforms.addTransform(Transforms.TRANSFORM_XPATHFILTERCHGP,
+ transforms.addTransform(XPathFilterCHGPContainer.TRANSFORM_XPATHFILTERCHGP,
xpathContainer.getElement());
}
@@ -1607,7 +1607,7 @@ public class TransformPerformanceTester
xpathContainer.setXPathNamespaceContext("ds",
Constants.SignatureSpecNS);
- transforms.addTransform(Transforms.TRANSFORM_XPATHFILTERCHGP,
+ transforms.addTransform(XPathFilterCHGPContainer.TRANSFORM_XPATHFILTERCHGP,
xpathContainer.getElement());
}
@@ -1662,7 +1662,7 @@ public class TransformPerformanceTester
xpathContainer.setXPathNamespaceContext("ds",
Constants.SignatureSpecNS);
- transforms.addTransform(Transforms.TRANSFORM_XPATHFILTERCHGP,
+ transforms.addTransform(XPathFilterCHGPContainer.TRANSFORM_XPATHFILTERCHGP,
xpathContainer.getElement());
}
@@ -1908,7 +1908,7 @@ public class TransformPerformanceTester
xpathContainer.setXPathNamespaceContext("ds",
Constants.SignatureSpecNS);
xpathContainer.setXPathNamespaceContext("x", "http://foo.bar/");
- transforms.addTransform(Transforms.TRANSFORM_XPATHFILTERCHGP,
+ transforms.addTransform(XPathFilterCHGPContainer.TRANSFORM_XPATHFILTERCHGP,
xpathContainer.getElement());
}
@@ -1953,36 +1953,35 @@ public class TransformPerformanceTester
Transforms transforms = new Transforms(doc);
{
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceIntersect(doc, "//E")
.getElement());
/*
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//B").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceSubtract(doc,
"//C").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//F").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceSubtract(doc,
"//G").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//H").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceSubtract(doc,
"//@x:attr").getElement());
*/
transforms.setXPathNamespaceContext("xmlns:x", "http://foo.bar/");
transforms
.setXPathNamespaceContext(Transforms
- .getDefaultPrefix(Transforms
- .TRANSFORM_XPATH2FILTER04), Transforms.TRANSFORM_XPATH2FILTER04);
+ .getDefaultPrefix(XPath2FilterContainer04.XPathFilter2NS), XPath2FilterContainer04.XPathFilter2NS);
}
sig.addDocument("", transforms);
@@ -2026,36 +2025,36 @@ public class TransformPerformanceTester
Transforms transforms = new Transforms(doc);
{
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceIntersect(doc, "//E")
.getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//B").getElement());
/*
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceSubtract(doc,
"//C").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//F").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceSubtract(doc,
"//G").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//H").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceSubtract(doc,
"//@x:attr").getElement());
*/
transforms.setXPathNamespaceContext("xmlns:x", "http://foo.bar/");
transforms
.setXPathNamespaceContext(Transforms
- .getDefaultPrefix(Transforms
- .TRANSFORM_XPATH2FILTER04), Transforms.TRANSFORM_XPATH2FILTER04);
+ .getDefaultPrefix(XPath2FilterContainer04.XPathFilter2NS),
+ XPath2FilterContainer04.XPathFilter2NS);
}
sig.addDocument("", transforms);
@@ -2099,22 +2098,22 @@ public class TransformPerformanceTester
Transforms transforms = new Transforms(doc);
{
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceIntersect(doc, "//E")
.getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//B").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceSubtract(doc, "//C")
.getElement());
transforms.setXPathNamespaceContext("xmlns:x", "http://foo.bar/");
transforms
.setXPathNamespaceContext(Transforms
- .getDefaultPrefix(Transforms
- .TRANSFORM_XPATH2FILTER04), Transforms.TRANSFORM_XPATH2FILTER04);
+ .getDefaultPrefix(XPath2FilterContainer04.XPathFilter2NS),
+ XPath2FilterContainer04.XPathFilter2NS);
}
sig.addDocument("", transforms);
@@ -2158,25 +2157,25 @@ public class TransformPerformanceTester
Transforms transforms = new Transforms(doc);
{
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceIntersect(doc, "//E")
.getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//B").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceSubtract(doc, "//C")
.getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//F").getElement());
transforms.setXPathNamespaceContext("xmlns:x", "http://foo.bar/");
transforms
.setXPathNamespaceContext(Transforms
- .getDefaultPrefix(Transforms
- .TRANSFORM_XPATH2FILTER04), Transforms.TRANSFORM_XPATH2FILTER04);
+ .getDefaultPrefix(XPath2FilterContainer04.XPathFilter2NS),
+ XPath2FilterContainer04.XPathFilter2NS);
}
sig.addDocument("", transforms);
@@ -2220,29 +2219,29 @@ public class TransformPerformanceTester
Transforms transforms = new Transforms(doc);
{
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceIntersect(doc, "//E")
.getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//B").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceSubtract(doc, "//C")
.getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//F").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceSubtract(doc, "//G")
.getElement());
transforms.setXPathNamespaceContext("xmlns:x", "http://foo.bar/");
transforms
.setXPathNamespaceContext(Transforms
- .getDefaultPrefix(Transforms
- .TRANSFORM_XPATH2FILTER04), Transforms.TRANSFORM_XPATH2FILTER04);
+ .getDefaultPrefix(XPath2FilterContainer04.XPathFilter2NS),
+ XPath2FilterContainer04.XPathFilter2NS);
}
sig.addDocument("", transforms);
@@ -2286,32 +2285,32 @@ public class TransformPerformanceTester
Transforms transforms = new Transforms(doc);
{
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceIntersect(doc, "//E")
.getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//B").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceSubtract(doc, "//C")
.getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//F").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceSubtract(doc, "//G")
.getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//H").getElement());
transforms.setXPathNamespaceContext("xmlns:x", "http://foo.bar/");
transforms
.setXPathNamespaceContext(Transforms
- .getDefaultPrefix(Transforms
- .TRANSFORM_XPATH2FILTER04), Transforms.TRANSFORM_XPATH2FILTER04);
+ .getDefaultPrefix(XPath2FilterContainer04.XPathFilter2NS),
+ XPath2FilterContainer04.XPathFilter2NS);
}
sig.addDocument("", transforms);
@@ -2355,36 +2354,35 @@ public class TransformPerformanceTester
Transforms transforms = new Transforms(doc);
{
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceIntersect(doc, "//E")
.getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//B").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceSubtract(doc, "//C")
.getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//F").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceSubtract(doc, "//G")
.getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04.newInstanceUnion(doc,
"//H").getElement());
- transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER04,
+ transforms.addTransform(XPath2FilterContainer04.XPathFilter2NS,
XPath2FilterContainer04
.newInstanceSubtract(doc, "//@x:attr")
.getElement());
transforms.setXPathNamespaceContext("xmlns:x", "http://foo.bar/");
transforms
.setXPathNamespaceContext(Transforms
- .getDefaultPrefix(Transforms
- .TRANSFORM_XPATH2FILTER04), Transforms.TRANSFORM_XPATH2FILTER04);
+ .getDefaultPrefix(XPath2FilterContainer04.XPathFilter2NS), XPath2FilterContainer04.XPathFilter2NS);
}
sig.addDocument("", transforms);
Modified: santuario/xml-security-java/trunk/samples/org/apache/xml/security/samples/transforms/SampleTransformXPathFilterCHGP.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/samples/org/apache/xml/security/samples/transforms/SampleTransformXPathFilterCHGP.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/samples/org/apache/xml/security/samples/transforms/SampleTransformXPathFilterCHGP.java (original)
+++ santuario/xml-security-java/trunk/samples/org/apache/xml/security/samples/transforms/SampleTransformXPathFilterCHGP.java Thu Dec 8 11:56:30 2011
@@ -100,7 +100,7 @@ public class SampleTransformXPathFilterC
xpathContainer.setXPathNamespaceContext("ds", Constants.SignatureSpecNS);
xpathContainer.setXPathNamespaceContext("x", "http://foo.bar/");
- transforms.addTransform(Transforms.TRANSFORM_XPATHFILTERCHGP, xpathContainer.getElement());
+ transforms.addTransform(XPathFilterCHGPContainer.TRANSFORM_XPATHFILTERCHGP, xpathContainer.getElement());
sig.addDocument("", transforms);
String secretKey = "secret";
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheTransform.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheTransform.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheTransform.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/ApacheTransform.java Thu Dec 8 11:56:30 2011
@@ -34,6 +34,7 @@ import org.w3c.dom.Node;
import org.apache.xml.security.signature.XMLSignatureInput;
import org.apache.xml.security.transforms.Transform;
+import org.apache.xml.security.transforms.Transforms;
import javax.xml.crypto.*;
import javax.xml.crypto.dom.DOMCryptoContext;
@@ -130,6 +131,17 @@ public abstract class ApacheTransform ex
getAlgorithm(), ex);
}
}
+
+ Boolean secureValidation = (Boolean)
+ xc.getProperty("org.apache.jcp.xml.dsig.secureValidation");
+ if (secureValidation != null && secureValidation.booleanValue()) {
+ String algorithm = getAlgorithm();
+ if (Transforms.TRANSFORM_XSLT.equals(algorithm)) {
+ throw new TransformException(
+ "Transform " + algorithm + " is forbidden when secure validation is enabled"
+ );
+ }
+ }
XMLSignatureInput in;
if (data instanceof ApacheData) {
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMManifest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMManifest.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMManifest.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMManifest.java Thu Dec 8 11:56:30 2011
@@ -91,11 +91,28 @@ public final class DOMManifest extends D
if (this.id != null) {
IdResolver.registerElementById(manElem, this.id);
}
+
+ Boolean secureValidation = (Boolean)
+ context.getProperty("org.apache.jcp.xml.dsig.secureValidation");
+ boolean secVal = false;
+ if (secureValidation != null && secureValidation.booleanValue()) {
+ secVal = true;
+ }
+
Element refElem = DOMUtils.getFirstChildElement(manElem);
List<Reference> refs = new ArrayList<Reference>();
+
+ int refCount = 0;
while (refElem != null) {
refs.add(new DOMReference(refElem, context, provider));
refElem = DOMUtils.getNextSiblingElement(refElem);
+
+ refCount++;
+ if (secVal && (refCount > DOMSignedInfo.MAXIMUM_REFERENCE_COUNT)) {
+ String error = "A maxiumum of " + DOMSignedInfo.MAXIMUM_REFERENCE_COUNT + " "
+ + "references per Manifest are allowed with secure validation";
+ throw new MarshalException(error);
+ }
}
this.references = Collections.unmodifiableList(refs);
}
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMReference.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMReference.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMReference.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMReference.java Thu Dec 8 11:56:30 2011
@@ -47,6 +47,7 @@ import org.w3c.dom.Element;
import org.w3c.dom.Node;
import org.apache.jcp.xml.dsig.internal.DigesterOutputStream;
+import org.apache.xml.security.algorithms.MessageDigestAlgorithm;
import org.apache.xml.security.exceptions.Base64DecodingException;
import org.apache.xml.security.signature.XMLSignatureInput;
import org.apache.xml.security.utils.Base64;
@@ -61,6 +62,11 @@ import org.apache.xml.security.utils.Uns
*/
public final class DOMReference extends DOMStructure
implements Reference, DOMURIReference {
+
+ /**
+ * The maximum number of transforms per reference, if secure validation is enabled.
+ */
+ public static final int MAXIMUM_TRANSFORM_COUNT = 5;
/**
* Look up useC14N11 system property. If true, an explicit C14N11 transform
@@ -79,7 +85,7 @@ public final class DOMReference extends
private static org.apache.commons.logging.Log log =
org.apache.commons.logging.LogFactory.getLog(DOMReference.class);
-
+
private final DigestMethod digestMethod;
private final String id;
private final List<Transform> transforms;
@@ -189,15 +195,31 @@ public final class DOMReference extends
Provider provider)
throws MarshalException
{
+ Boolean secureValidation = (Boolean)
+ context.getProperty("org.apache.jcp.xml.dsig.secureValidation");
+ boolean secVal = false;
+ if (secureValidation != null && secureValidation.booleanValue()) {
+ secVal = true;
+ }
+
// unmarshal Transforms, if specified
Element nextSibling = DOMUtils.getFirstChildElement(refElem);
List<Transform> transforms = new ArrayList<Transform>(5);
if (nextSibling.getLocalName().equals("Transforms")) {
Element transformElem = DOMUtils.getFirstChildElement(nextSibling);
+
+ int transformCount = 0;
while (transformElem != null) {
transforms.add
(new DOMTransform(transformElem, context, provider));
transformElem = DOMUtils.getNextSiblingElement(transformElem);
+
+ transformCount++;
+ if (secVal && (transformCount > MAXIMUM_TRANSFORM_COUNT)) {
+ String error = "A maxiumum of " + MAXIMUM_TRANSFORM_COUNT + " "
+ + "transforms per Reference are allowed with secure validation";
+ throw new MarshalException(error);
+ }
}
nextSibling = DOMUtils.getNextSiblingElement(nextSibling);
}
@@ -205,6 +227,11 @@ public final class DOMReference extends
// unmarshal DigestMethod
Element dmElem = nextSibling;
this.digestMethod = DOMDigestMethod.unmarshal(dmElem);
+ if (secVal && MessageDigestAlgorithm.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5.equals(digestMethod)) {
+ throw new MarshalException(
+ "It is forbidden to use algorithm " + digestMethod + " when secure validation is enabled"
+ );
+ }
// unmarshal DigestValue
try {
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMRetrievalMethod.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMRetrievalMethod.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMRetrievalMethod.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMRetrievalMethod.java Thu Dec 8 11:56:30 2011
@@ -125,10 +125,19 @@ public final class DOMRetrievalMethod ex
// get here node
here = rmElem.getAttributeNodeNS(null, "URI");
+
+ Boolean secureValidation = (Boolean)
+ context.getProperty("org.apache.jcp.xml.dsig.secureValidation");
+ boolean secVal = false;
+ if (secureValidation != null && secureValidation.booleanValue()) {
+ secVal = true;
+ }
// get Transforms, if specified
List<Transform> transforms = new ArrayList<Transform>();
Element transformsElem = DOMUtils.getFirstChildElement(rmElem);
+
+ int transformCount = 0;
if (transformsElem != null) {
Element transformElem =
DOMUtils.getFirstChildElement(transformsElem);
@@ -136,6 +145,13 @@ public final class DOMRetrievalMethod ex
transforms.add
(new DOMTransform(transformElem, context, provider));
transformElem = DOMUtils.getNextSiblingElement(transformElem);
+
+ transformCount++;
+ if (secVal && (transformCount > DOMReference.MAXIMUM_TRANSFORM_COUNT)) {
+ String error = "A maxiumum of " + DOMReference.MAXIMUM_TRANSFORM_COUNT + " "
+ + "transforms per Reference are allowed with secure validation";
+ throw new MarshalException(error);
+ }
}
}
if (transforms.isEmpty()) {
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMSignedInfo.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMSignedInfo.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMSignedInfo.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMSignedInfo.java Thu Dec 8 11:56:30 2011
@@ -41,6 +41,7 @@ import org.w3c.dom.Element;
import org.w3c.dom.Node;
import org.apache.xml.security.utils.Base64;
+import org.apache.xml.security.utils.Constants;
import org.apache.xml.security.utils.UnsyncBufferedOutputStream;
/**
@@ -49,10 +50,23 @@ import org.apache.xml.security.utils.Uns
* @author Sean Mullan
*/
public final class DOMSignedInfo extends DOMStructure implements SignedInfo {
+
+ /**
+ * The maximum number of references per Manifest, if secure validation is enabled.
+ */
+ public static final int MAXIMUM_REFERENCE_COUNT = 30;
private static org.apache.commons.logging.Log log =
org.apache.commons.logging.LogFactory.getLog(DOMSignedInfo.class);
+ /** Signature - NOT Recommended RSAwithMD5 */
+ private static final String ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5 =
+ Constants.MoreAlgorithmsSpecNS + "rsa-md5";
+
+ /** HMAC - NOT Recommended HMAC-MD5 */
+ private static final String ALGO_ID_MAC_HMAC_NOT_RECOMMENDED_MD5 =
+ Constants.MoreAlgorithmsSpecNS + "hmac-md5";
+
private List<Reference> references;
private CanonicalizationMethod canonicalizationMethod;
private SignatureMethod signatureMethod;
@@ -138,13 +152,36 @@ public final class DOMSignedInfo extends
// unmarshal SignatureMethod
Element smElem = DOMUtils.getNextSiblingElement(cmElem);
signatureMethod = DOMSignatureMethod.unmarshal(smElem);
+
+ Boolean secureValidation = (Boolean)
+ context.getProperty("org.apache.jcp.xml.dsig.secureValidation");
+ boolean secVal = false;
+ if (secureValidation != null && secureValidation.booleanValue()) {
+ secVal = true;
+ }
+ if (secVal && ((ALGO_ID_MAC_HMAC_NOT_RECOMMENDED_MD5.equals(signatureMethod)
+ || ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5.equals(signatureMethod)))) {
+ throw new MarshalException(
+ "It is forbidden to use algorithm " + signatureMethod + " when secure validation is enabled"
+ );
+ }
+
// unmarshal References
ArrayList<Reference> refList = new ArrayList<Reference>(5);
Element refElem = DOMUtils.getNextSiblingElement(smElem);
+
+ int refCount = 0;
while (refElem != null) {
refList.add(new DOMReference(refElem, context, provider));
refElem = DOMUtils.getNextSiblingElement(refElem);
+
+ refCount++;
+ if (secVal && (refCount > MAXIMUM_REFERENCE_COUNT)) {
+ String error = "A maxiumum of " + MAXIMUM_REFERENCE_COUNT + " "
+ + "references per Manifest are allowed with secure validation";
+ throw new MarshalException(error);
+ }
}
references = Collections.unmodifiableList(refList);
}
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMURIDereferencer.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMURIDereferencer.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMURIDereferencer.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMURIDereferencer.java Thu Dec 8 11:56:30 2011
@@ -85,10 +85,16 @@ public class DOMURIDereferencer implemen
}
}
+ Boolean secureValidation = (Boolean)
+ context.getProperty("org.apache.jcp.xml.dsig.secureValidation");
+ boolean secVal = false;
+ if (secureValidation != null && secureValidation.booleanValue()) {
+ secVal = true;
+ }
try {
String baseURI = context.getBaseURI();
ResourceResolver apacheResolver =
- ResourceResolver.getInstance(uriAttr, baseURI);
+ ResourceResolver.getInstance(uriAttr, baseURI, secVal);
XMLSignatureInput in = apacheResolver.resolve(uriAttr, baseURI);
if (in.isOctetStream()) {
return new ApacheOctetStreamData(in);
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/algorithms/SignatureAlgorithm.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/algorithms/SignatureAlgorithm.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/algorithms/SignatureAlgorithm.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/algorithms/SignatureAlgorithm.java Thu Dec 8 11:56:30 2011
@@ -104,6 +104,20 @@ public class SignatureAlgorithm extends
* @throws XMLSecurityException
*/
public SignatureAlgorithm(Element element, String BaseURI) throws XMLSecurityException {
+ this(element, BaseURI, false);
+ }
+
+ /**
+ * Constructor SignatureAlgorithm
+ *
+ * @param element
+ * @param BaseURI
+ * @param secureValidation
+ * @throws XMLSecurityException
+ */
+ public SignatureAlgorithm(
+ Element element, String BaseURI, boolean secureValidation
+ ) throws XMLSecurityException {
super(element, BaseURI);
algorithmURI = this.getURI();
@@ -112,6 +126,13 @@ public class SignatureAlgorithm extends
IdResolver.registerElementById(element, id);
}
+ if (secureValidation && (XMLSignature.ALGO_ID_MAC_HMAC_NOT_RECOMMENDED_MD5.equals(algorithmURI)
+ || XMLSignature.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5.equals(algorithmURI))) {
+ Object exArgs[] = { algorithmURI };
+
+ throw new XMLSecurityException("signature.signatureAlgorithm", exArgs);
+ }
+
signatureAlgorithm = getSignatureAlgorithmSpi(algorithmURI);
signatureAlgorithm.engineGetContextFromElement(this.constructionElement);
}
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/encryption/XMLCipher.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/encryption/XMLCipher.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/encryption/XMLCipher.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/encryption/XMLCipher.java Thu Dec 8 11:56:30 2011
@@ -228,6 +228,8 @@ public class XMLCipher {
private SecureRandom random;
+ private boolean secureValidation;
+
/**
* Set the Serializer algorithm to use
*/
@@ -564,6 +566,13 @@ public class XMLCipher {
cipherMode = opmode;
this.key = key;
}
+
+ /**
+ * Set whether secure validation is enabled or not. The default is false.
+ */
+ public void setSecureValidation(boolean secureValidation) {
+ this.secureValidation = secureValidation;
+ }
/**
* Get the EncryptedData being build
@@ -1309,6 +1318,7 @@ public class XMLCipher {
KeyInfo ki = encryptedKey.getKeyInfo();
if (ki != null) {
+ ki.setSecureValidation(secureValidation);
try {
String keyWrapAlg = encryptedKey.getEncryptionMethod().getAlgorithm();
String keyType = JCEMapper.getJCEKeyAlgorithmFromURI(keyWrapAlg);
@@ -1332,6 +1342,7 @@ public class XMLCipher {
// Obtain the encrypted octets
XMLCipherInput cipherInput = new XMLCipherInput(encryptedKey);
+ cipherInput.setSecureValidation(secureValidation);
byte [] encryptedBytes = cipherInput.getBytes();
String jceKeyAlgorithm = JCEMapper.getJCEKeyAlgorithmFromURI(algorithm);
@@ -1498,11 +1509,14 @@ public class XMLCipher {
if (ki != null) {
try {
// Add a EncryptedKey resolver
- ki.registerInternalKeyResolver(
+ EncryptedKeyResolver resolver =
new EncryptedKeyResolver(
encryptedData.getEncryptionMethod().getAlgorithm(), kek
- )
- );
+ );
+
+ // Add a EncryptedKey resolver
+ ki.registerInternalKeyResolver(resolver);
+ ki.setSecureValidation(secureValidation);
key = ki.getSecretKey();
} catch (KeyResolverException kre) {
if (log.isDebugEnabled()) {
@@ -1521,6 +1535,7 @@ public class XMLCipher {
// Obtain the encrypted octets
XMLCipherInput cipherInput = new XMLCipherInput(encryptedData);
+ cipherInput.setSecureValidation(secureValidation);
byte[] encryptedBytes = cipherInput.getBytes();
// Now create the working cipher
@@ -2032,7 +2047,9 @@ public class XMLCipher {
Constants.SignatureSpecNS, Constants._TAG_KEYINFO).item(0);
if (null != keyInfoElement) {
try {
- result.setKeyInfo(new KeyInfo(keyInfoElement, null));
+ KeyInfo ki = new KeyInfo(keyInfoElement, null);
+ ki.setSecureValidation(secureValidation);
+ result.setKeyInfo(ki);
} catch (XMLSecurityException xse) {
throw new XMLEncryptionException("Error loading Key Info", xse);
}
@@ -2087,7 +2104,9 @@ public class XMLCipher {
Constants.SignatureSpecNS, Constants._TAG_KEYINFO).item(0);
if (null != keyInfoElement) {
try {
- result.setKeyInfo(new KeyInfo(keyInfoElement, null));
+ KeyInfo ki = new KeyInfo(keyInfoElement, null);
+ ki.setSecureValidation(secureValidation);
+ result.setKeyInfo(ki);
} catch (XMLSecurityException xse) {
throw new XMLEncryptionException("Error loading Key Info", xse);
}
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/encryption/XMLCipherInput.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/encryption/XMLCipherInput.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/encryption/XMLCipherInput.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/encryption/XMLCipherInput.java Thu Dec 8 11:56:30 2011
@@ -53,6 +53,8 @@ public class XMLCipherInput {
/** MODES */
private int mode;
+
+ private boolean secureValidation;
/**
* Constructor for processing encrypted octets
@@ -82,6 +84,13 @@ public class XMLCipherInput {
throw new XMLEncryptionException("CipherData is null");
}
}
+
+ /**
+ * Set whether secure validation is enabled or not. The default is false.
+ */
+ public void setSecureValidation(boolean secureValidation) {
+ this.secureValidation = secureValidation;
+ }
/**
* Dereferences the input and returns it as a single byte array.
@@ -119,7 +128,7 @@ public class XMLCipherInput {
try {
ResourceResolver resolver =
- ResourceResolver.getInstance(uriAttr, null);
+ ResourceResolver.getInstance(uriAttr, null, secureValidation);
input = resolver.resolve(uriAttr, null);
} catch (ResourceResolverException ex) {
throw new XMLEncryptionException("empty", ex);
@@ -144,6 +153,7 @@ public class XMLCipherInput {
try {
org.apache.xml.security.transforms.Transforms dsTransforms =
transforms.getDSTransforms();
+ dsTransforms.setSecureValidation(secureValidation);
input = dsTransforms.performTransforms(input);
} catch (TransformationException ex) {
throw new XMLEncryptionException("empty", ex);
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/KeyInfo.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/KeyInfo.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/KeyInfo.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/KeyInfo.java Thu Dec 8 11:56:30 2011
@@ -113,6 +113,8 @@ public class KeyInfo extends SignatureEl
* Stores the individual (per-KeyInfo) {@link KeyResolverSpi}s
*/
private List<KeyResolverSpi> internalKeyResolvers = new ArrayList<KeyResolverSpi>();
+
+ private boolean secureValidation;
/**
* Constructor KeyInfo
@@ -139,6 +141,13 @@ public class KeyInfo extends SignatureEl
IdResolver.registerElementById(element, id);
}
}
+
+ /**
+ * Set whether secure processing is enabled or not. The default is false.
+ */
+ public void setSecureValidation(boolean secureValidation) {
+ this.secureValidation = secureValidation;
+ }
/**
* Sets the <code>Id</code> attribute
@@ -735,6 +744,7 @@ public class KeyInfo extends SignatureEl
Iterator<KeyResolverSpi> it = KeyResolver.iterator();
while (it.hasNext()) {
KeyResolverSpi keyResolver = it.next();
+ keyResolver.setSecureValidation(secureValidation);
Node currentChild = this.constructionElement.getFirstChild();
String uri = this.getBaseURI();
while (currentChild != null) {
@@ -767,7 +777,7 @@ public class KeyInfo extends SignatureEl
if (log.isDebugEnabled()) {
log.debug("Try " + keyResolver.getClass().getName());
}
-
+ keyResolver.setSecureValidation(secureValidation);
Node currentChild = this.constructionElement.getFirstChild();
String uri = this.getBaseURI();
while (currentChild != null) {
@@ -848,6 +858,7 @@ public class KeyInfo extends SignatureEl
Iterator<KeyResolverSpi> it = KeyResolver.iterator();
while (it.hasNext()) {
KeyResolverSpi keyResolver = it.next();
+ keyResolver.setSecureValidation(secureValidation);
X509Certificate cert = applyCurrentResolver(uri, keyResolver);
if (cert != null) {
return cert;
@@ -897,6 +908,7 @@ public class KeyInfo extends SignatureEl
if (log.isDebugEnabled()) {
log.debug("Try " + keyResolver.getClass().getName());
}
+ keyResolver.setSecureValidation(secureValidation);
X509Certificate cert = applyCurrentResolver(uri, keyResolver);
if (cert != null) {
return cert;
@@ -951,6 +963,7 @@ public class KeyInfo extends SignatureEl
Iterator<KeyResolverSpi> it = KeyResolver.iterator();
while (it.hasNext()) {
KeyResolverSpi keyResolver = it.next();
+ keyResolver.setSecureValidation(secureValidation);
Node currentChild = this.constructionElement.getFirstChild();
String uri = this.getBaseURI();
@@ -985,7 +998,7 @@ public class KeyInfo extends SignatureEl
if (log.isDebugEnabled()) {
log.debug("Try " + keyResolver.getClass().getName());
}
-
+ keyResolver.setSecureValidation(secureValidation);
Node currentChild = this.constructionElement.getFirstChild();
String uri = this.getBaseURI();
while (currentChild != null) {
@@ -1050,6 +1063,7 @@ public class KeyInfo extends SignatureEl
Iterator<KeyResolverSpi> it = KeyResolver.iterator();
while (it.hasNext()) {
KeyResolverSpi keyResolver = it.next();
+ keyResolver.setSecureValidation(secureValidation);
Node currentChild = this.constructionElement.getFirstChild();
String uri = this.getBaseURI();
@@ -1084,7 +1098,7 @@ public class KeyInfo extends SignatureEl
if (log.isDebugEnabled()) {
log.debug("Try " + keyResolver.getClass().getName());
}
-
+ keyResolver.setSecureValidation(secureValidation);
Node currentChild = this.constructionElement.getFirstChild();
String uri = this.getBaseURI();
while (currentChild != null) {
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/keyresolver/KeyResolverSpi.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/keyresolver/KeyResolverSpi.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/keyresolver/KeyResolverSpi.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/keyresolver/KeyResolverSpi.java Thu Dec 8 11:56:30 2011
@@ -45,6 +45,15 @@ public abstract class KeyResolverSpi {
protected boolean globalResolver = false;
+ protected boolean secureValidation;
+
+ /**
+ * Set whether secure validation is enabled or not. The default is false.
+ */
+ public void setSecureValidation(boolean secureValidation) {
+ this.secureValidation = secureValidation;
+ }
+
/**
* This method returns whether the KeyResolverSpi is able to perform the requested action.
*
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/RetrievalMethodResolver.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/RetrievalMethodResolver.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/RetrievalMethodResolver.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/keys/keyresolver/implementations/RetrievalMethodResolver.java Thu Dec 8 11:56:30 2011
@@ -89,7 +89,7 @@ public class RetrievalMethodResolver ext
// Create a retrieval method over the given element
RetrievalMethod rm = new RetrievalMethod(element, BaseURI);
String type = rm.getType();
- XMLSignatureInput resource = resolveInput(rm, BaseURI);
+ XMLSignatureInput resource = resolveInput(rm, BaseURI, secureValidation);
if (RetrievalMethod.TYPE_RAWX509.equals(type)) {
// a raw certificate, direct parsing is done!
X509Certificate cert = getRawCertificate(resource);
@@ -103,8 +103,16 @@ public class RetrievalMethodResolver ext
// Check to make sure that the reference is not to another RetrievalMethod
// which points to this element
if (XMLUtils.elementIsInSignatureSpace(e, Constants._TAG_RETRIEVALMETHOD)) {
+ if (secureValidation) {
+ String error = "Error: It is forbidden to have one RetrievalMethod "
+ + "point to another with secure validation";
+ if (log.isDebugEnabled()) {
+ log.debug(error);
+ }
+ return null;
+ }
RetrievalMethod rm2 = new RetrievalMethod(e, BaseURI);
- XMLSignatureInput resource2 = resolveInput(rm2, BaseURI);
+ XMLSignatureInput resource2 = resolveInput(rm2, BaseURI, secureValidation);
Element e2 = obtainReferenceElement(resource2);
if (e2 == element) {
if (log.isDebugEnabled()) {
@@ -155,7 +163,7 @@ public class RetrievalMethodResolver ext
try {
RetrievalMethod rm = new RetrievalMethod(element, BaseURI);
String type = rm.getType();
- XMLSignatureInput resource = resolveInput(rm, BaseURI);
+ XMLSignatureInput resource = resolveInput(rm, BaseURI, secureValidation);
if (RetrievalMethod.TYPE_RAWX509.equals(type)) {
X509Certificate cert = getRawCertificate(resource);
return cert;
@@ -166,8 +174,16 @@ public class RetrievalMethodResolver ext
// Check to make sure that the reference is not to another RetrievalMethod
// which points to this element
if (XMLUtils.elementIsInSignatureSpace(e, Constants._TAG_RETRIEVALMETHOD)) {
+ if (secureValidation) {
+ String error = "Error: It is forbidden to have one RetrievalMethod "
+ + "point to another with secure validation";
+ if (log.isDebugEnabled()) {
+ log.debug(error);
+ }
+ return null;
+ }
RetrievalMethod rm2 = new RetrievalMethod(e, BaseURI);
- XMLSignatureInput resource2 = resolveInput(rm2, BaseURI);
+ XMLSignatureInput resource2 = resolveInput(rm2, BaseURI, secureValidation);
Element e2 = obtainReferenceElement(resource2);
if (e2 == element) {
if (log.isDebugEnabled()) {
@@ -284,12 +300,12 @@ public class RetrievalMethodResolver ext
* @throws XMLSecurityException
*/
private static XMLSignatureInput resolveInput(
- RetrievalMethod rm, String BaseURI
+ RetrievalMethod rm, String BaseURI, boolean secureValidation
) throws XMLSecurityException {
Attr uri = rm.getURIAttr();
// Apply the transforms
Transforms transforms = rm.getTransforms();
- ResourceResolver resRes = ResourceResolver.getInstance(uri, BaseURI);
+ ResourceResolver resRes = ResourceResolver.getInstance(uri, BaseURI, secureValidation);
if (resRes != null) {
XMLSignatureInput resource = resRes.resolve(uri, BaseURI);
if (transforms != null) {
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/resource/config.xml
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/resource/config.xml?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
Binary files - no diff available.
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/resource/xmlsecurity_de.properties
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/resource/xmlsecurity_de.properties?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
Binary files - no diff available.
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/resource/xmlsecurity_en.properties
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/resource/xmlsecurity_en.properties?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
Binary files - no diff available.
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/Manifest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/Manifest.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/Manifest.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/Manifest.java Thu Dec 8 11:56:30 2011
@@ -50,6 +50,11 @@ import org.xml.sax.SAXException;
* <p> This element holds the <code>Reference</code> elements</p>
*/
public class Manifest extends SignatureElementProxy {
+
+ /**
+ * The maximum number of references per Manifest, if secure validation is enabled.
+ */
+ public static final int MAXIMUM_REFERENCE_COUNT = 30;
/** {@link org.apache.commons.logging} logging facility */
private static org.apache.commons.logging.Log log =
@@ -67,6 +72,8 @@ public class Manifest extends SignatureE
/** Field perManifestResolvers */
private List<ResourceResolver> perManifestResolvers = null;
+
+ private boolean secureValidation;
/**
* Constructs {@link Manifest}
@@ -89,12 +96,27 @@ public class Manifest extends SignatureE
* @throws XMLSecurityException
*/
public Manifest(Element element, String baseURI) throws XMLSecurityException {
+ this(element, baseURI, false);
+
+ }
+ /**
+ * Constructor Manifest
+ *
+ * @param element
+ * @param baseURI
+ * @param secureValidation
+ * @throws XMLSecurityException
+ */
+ public Manifest(
+ Element element, String baseURI, boolean secureValidation
+ ) throws XMLSecurityException {
super(element, baseURI);
String id = XMLUtils.getAttributeValue(element, "Id");
if (id != null) {
IdResolver.registerElementById(element, id);
}
+ this.secureValidation = secureValidation;
// check out Reference children
this.referencesEl =
@@ -109,6 +131,12 @@ public class Manifest extends SignatureE
throw new DOMException(DOMException.WRONG_DOCUMENT_ERR,
I18n.translate("xml.WrongContent", exArgs));
}
+
+ if (secureValidation && le > MAXIMUM_REFERENCE_COUNT) {
+ Object exArgs[] = { le, MAXIMUM_REFERENCE_COUNT };
+
+ throw new XMLSecurityException("signature.tooManyReferences", exArgs);
+ }
// create List
this.references = new ArrayList<Reference>(le);
@@ -199,7 +227,8 @@ public class Manifest extends SignatureE
public Reference item(int i) throws XMLSecurityException {
if (this.references.get(i) == null) {
// not yet constructed, so _we_ have to
- Reference ref = new Reference(referencesEl[i], this.baseURI, this);
+ Reference ref =
+ new Reference(referencesEl[i], this.baseURI, this, secureValidation);
this.references.set(i, ref);
}
@@ -288,12 +317,17 @@ public class Manifest extends SignatureE
if (referencesEl.length == 0) {
throw new XMLSecurityException("empty");
}
+ if (secureValidation && referencesEl.length > MAXIMUM_REFERENCE_COUNT) {
+ Object exArgs[] = { referencesEl.length, MAXIMUM_REFERENCE_COUNT };
+
+ throw new XMLSecurityException("signature.tooManyReferences", exArgs);
+ }
this.verificationResults = new boolean[referencesEl.length];
boolean verify = true;
for (int i = 0; i < this.referencesEl.length; i++) {
Reference currentRef =
- new Reference(referencesEl[i], this.baseURI, this);
+ new Reference(referencesEl[i], this.baseURI, this, secureValidation);
this.references.set(i, currentRef);
@@ -332,7 +366,9 @@ public class Manifest extends SignatureE
) {
try {
referencedManifest =
- new Manifest((Element) n, signedManifestNodes.getSourceURI());
+ new Manifest(
+ (Element)n, signedManifestNodes.getSourceURI(), secureValidation
+ );
break findManifest;
} catch (XMLSecurityException ex) {
if (log.isDebugEnabled()) {
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/Reference.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/Reference.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/Reference.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/Reference.java Thu Dec 8 11:56:30 2011
@@ -106,6 +106,13 @@ public class Reference extends Signature
/** Field CacheSignedNodes */
public static final boolean CacheSignedNodes = false;
+
+ /**
+ * The maximum number of transforms per reference, if secure validation is enabled.
+ */
+ public static final int MAXIMUM_TRANSFORM_COUNT = 5;
+
+ private boolean secureValidation;
/**
* Look up useC14N11 system property. If true, an explicit C14N11 transform
@@ -182,6 +189,20 @@ public class Reference extends Signature
XMLUtils.addReturnToElement(this.constructionElement);
}
+
+ /**
+ * Build a {@link Reference} from an {@link Element}
+ *
+ * @param element <code>Reference</code> element
+ * @param BaseURI the URI of the resource where the XML instance was stored
+ * @param manifest is the {@link Manifest} of {@link SignedInfo} in which the Reference occurs.
+ * We need this because the Manifest has the individual {@link ResourceResolver}s which have
+ * been set by the user
+ * @throws XMLSecurityException
+ */
+ protected Reference(Element element, String BaseURI, Manifest manifest) throws XMLSecurityException {
+ this(element, BaseURI, manifest, false);
+ }
/**
* Build a {@link Reference} from an {@link Element}
@@ -189,18 +210,26 @@ public class Reference extends Signature
* @param element <code>Reference</code> element
* @param BaseURI the URI of the resource where the XML instance was stored
* @param manifest is the {@link Manifest} of {@link SignedInfo} in which the Reference occurs.
+ * @param secureValidation whether secure validation is enabled or not
* We need this because the Manifest has the individual {@link ResourceResolver}s which have
* been set by the user
* @throws XMLSecurityException
*/
- protected Reference(Element element, String BaseURI, Manifest manifest)
+ protected Reference(Element element, String BaseURI, Manifest manifest, boolean secureValidation)
throws XMLSecurityException {
super(element, BaseURI);
+ this.secureValidation = secureValidation;
this.baseURI = BaseURI;
Element el = XMLUtils.getNextElement(element.getFirstChild());
if (Constants._TAG_TRANSFORMS.equals(el.getLocalName())
&& Constants.SignatureSpecNS.equals(el.getNamespaceURI())) {
transforms = new Transforms(el, this.baseURI);
+ transforms.setSecureValidation(secureValidation);
+ if (secureValidation && transforms.getLength() > MAXIMUM_TRANSFORM_COUNT) {
+ Object exArgs[] = { transforms.getLength(), MAXIMUM_TRANSFORM_COUNT };
+
+ throw new XMLSecurityException("signature.tooManyTransforms", exArgs);
+ }
el = XMLUtils.getNextElement(el.getNextSibling());
}
digestMethodElem = el;
@@ -226,6 +255,12 @@ public class Reference extends Signature
if (uri == null) {
return null;
}
+
+ if (secureValidation && MessageDigestAlgorithm.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5.equals(uri)) {
+ Object exArgs[] = { uri };
+
+ throw new XMLSignatureException("signature.signatureAlgorithm", exArgs);
+ }
return MessageDigestAlgorithm.getInstance(this.doc, uri);
}
@@ -378,7 +413,7 @@ public class Reference extends Signature
ResourceResolver resolver =
ResourceResolver.getInstance(
- URIAttr, this.baseURI, this.manifest.getPerManifestResolvers()
+ URIAttr, this.baseURI, this.manifest.getPerManifestResolvers(), secureValidation
);
if (resolver == null) {
@@ -640,6 +675,7 @@ public class Reference extends Signature
&& !output.isOctetStream()) {
if (transforms == null) {
transforms = new Transforms(this.doc);
+ transforms.setSecureValidation(secureValidation);
this.constructionElement.insertBefore(transforms.getElement(), digestMethodElem);
}
transforms.addTransform(Transforms.TRANSFORM_C14N11_OMIT_COMMENTS);
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/SignedInfo.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/SignedInfo.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/SignedInfo.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/SignedInfo.java Thu Dec 8 11:56:30 2011
@@ -159,13 +159,31 @@ public class SignedInfo extends Manifest
* Answer</A>
*/
public SignedInfo(Element element, String baseURI) throws XMLSecurityException {
+ this(element, baseURI, false);
+ }
+
+ /**
+ * Build a {@link SignedInfo} from an {@link Element}
+ *
+ * @param element <code>SignedInfo</code>
+ * @param baseURI the URI of the resource where the XML instance was stored
+ * @param secureValidation whether secure validation is enabled or not
+ * @throws XMLSecurityException
+ * @see <A HREF="http://lists.w3.org/Archives/Public/w3c-ietf-xmldsig/2001OctDec/0033.html">
+ * Question</A>
+ * @see <A HREF="http://lists.w3.org/Archives/Public/w3c-ietf-xmldsig/2001OctDec/0054.html">
+ * Answer</A>
+ */
+ public SignedInfo(
+ Element element, String baseURI, boolean secureValidation
+ ) throws XMLSecurityException {
// Parse the Reference children and Id attribute in the Manifest
- super(reparseSignedInfoElem(element), baseURI);
+ super(reparseSignedInfoElem(element), baseURI, secureValidation);
c14nMethod = XMLUtils.getNextElement(element.getFirstChild());
signatureMethod = XMLUtils.getNextElement(c14nMethod.getNextSibling());
this.signatureAlgorithm =
- new SignatureAlgorithm(signatureMethod, this.getBaseURI());
+ new SignatureAlgorithm(signatureMethod, this.getBaseURI(), secureValidation);
}
private static Element reparseSignedInfoElem(Element element)
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/XMLSignature.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/XMLSignature.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/XMLSignature.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/XMLSignature.java Thu Dec 8 11:56:30 2011
@@ -311,19 +311,34 @@ public final class XMLSignature extends
this.constructionElement.appendChild(signatureValueElement);
XMLUtils.addReturnToElement(this.constructionElement);
}
+
+ /**
+ * This will parse the element and construct the Java Objects.
+ * That will allow a user to validate the signature.
+ *
+ * @param element ds:Signature element that contains the whole signature
+ * @param baseURI URI to be prepended to all relative URIs
+ * @throws XMLSecurityException
+ * @throws XMLSignatureException if the signature is badly formatted
+ */
+ public XMLSignature(Element element, String baseURI)
+ throws XMLSignatureException, XMLSecurityException {
+ this(element, baseURI, false);
+ }
/**
* This will parse the element and construct the Java Objects.
* That will allow a user to validate the signature.
*
* @param element ds:Signature element that contains the whole signature
- * @param BaseURI URI to be prepended to all relative URIs
+ * @param baseURI URI to be prepended to all relative URIs
+ * @param secureValidation whether secure secureValidation is enabled or not
* @throws XMLSecurityException
* @throws XMLSignatureException if the signature is badly formatted
*/
- public XMLSignature(Element element, String BaseURI)
+ public XMLSignature(Element element, String baseURI, boolean secureValidation)
throws XMLSignatureException, XMLSecurityException {
- super(element, BaseURI);
+ super(element, baseURI);
// check out SignedInfo child
Element signedInfoElem = XMLUtils.getNextElement(element.getFirstChild());
@@ -335,7 +350,7 @@ public final class XMLSignature extends
}
// create a SignedInfo object from that element
- this.signedInfo = new SignedInfo(signedInfoElem, BaseURI);
+ this.signedInfo = new SignedInfo(signedInfoElem, baseURI, secureValidation);
// get signedInfoElem again in case it has changed
signedInfoElem = XMLUtils.getNextElement(element.getFirstChild());
@@ -361,7 +376,8 @@ public final class XMLSignature extends
if (keyInfoElem != null
&& keyInfoElem.getNamespaceURI().equals(Constants.SignatureSpecNS)
&& keyInfoElem.getLocalName().equals(Constants._TAG_KEYINFO)) {
- this.keyInfo = new KeyInfo(keyInfoElem, BaseURI);
+ this.keyInfo = new KeyInfo(keyInfoElem, baseURI);
+ this.keyInfo.setSecureValidation(secureValidation);
}
// <element ref="ds:Object" minOccurs="0" maxOccurs="unbounded"/>
@@ -382,9 +398,9 @@ public final class XMLSignature extends
Element childElem = (Element)child;
String tag = childElem.getLocalName();
if (tag.equals("Manifest")) {
- new Manifest(childElem, BaseURI);
+ new Manifest(childElem, baseURI);
} else if (tag.equals("SignatureProperties")) {
- new SignatureProperties(childElem, BaseURI);
+ new SignatureProperties(childElem, baseURI);
}
}
}
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/Transform.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/Transform.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/Transform.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/Transform.java Thu Dec 8 11:56:30 2011
@@ -252,9 +252,6 @@ public final class Transform extends Sig
transformSpiHash.put(
Transforms.TRANSFORM_XPATH2FILTER, TransformXPath2Filter.class
);
- transformSpiHash.put(
- Transforms.TRANSFORM_XPATH2FILTER04, TransformXPath2Filter.class
- );
}
/**
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/Transforms.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/Transforms.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/Transforms.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/Transforms.java Thu Dec 8 11:56:30 2011
@@ -93,18 +93,10 @@ public class Transforms extends Signatur
public static final String TRANSFORM_XPOINTER
= "http://www.w3.org/TR/2001/WD-xptr-20010108";
- /** Transform - XPath Filter v2.0 */
- public static final String TRANSFORM_XPATH2FILTER04
- = "http://www.w3.org/2002/04/xmldsig-filter2";
-
/** Transform - XPath Filter */
public static final String TRANSFORM_XPATH2FILTER
= "http://www.w3.org/2002/06/xmldsig-filter2";
- /** Transform - XPath Filter CHGP private */
- public static final String TRANSFORM_XPATHFILTERCHGP
- = "http://www.nue.et-inf.uni-siegen.de/~geuer-pollmann/#xpathFilter";
-
/** {@link org.apache.commons.logging} logging facility */
private static org.apache.commons.logging.Log log =
org.apache.commons.logging.LogFactory.getLog(Transforms.class);
@@ -112,6 +104,8 @@ public class Transforms extends Signatur
private Element[] transforms;
protected Transforms() { };
+
+ private boolean secureValidation;
/**
* Constructs {@link Transforms}.
@@ -150,6 +144,13 @@ public class Transforms extends Signatur
throw new TransformationException("xml.WrongContent", exArgs);
}
}
+
+ /**
+ * Set whether secure validation is enabled or not. The default is false.
+ */
+ public void setSecureValidation(boolean secureValidation) {
+ this.secureValidation = secureValidation;
+ }
/**
* Adds the <code>Transform</code> with the specified <code>Transform
@@ -263,13 +264,16 @@ public class Transforms extends Signatur
int last = this.getLength() - 1;
for (int i = 0; i < last; i++) {
Transform t = this.item(i);
+ String uri = t.getURI();
if (log.isDebugEnabled()) {
- log.debug("Perform the (" + i + ")th " + t.getURI() + " transform");
+ log.debug("Perform the (" + i + ")th " + uri + " transform");
}
+ checkSecureValidation(t);
xmlSignatureInput = t.performTransform(xmlSignatureInput);
}
if (last >= 0) {
Transform t = this.item(last);
+ checkSecureValidation(t);
xmlSignatureInput = t.performTransform(xmlSignatureInput, os);
}
@@ -282,6 +286,17 @@ public class Transforms extends Signatur
throw new TransformationException("empty", ex);
}
}
+
+ private void checkSecureValidation(Transform transform) throws TransformationException {
+ String uri = transform.getURI();
+ if (Transforms.TRANSFORM_XSLT.equals(uri)) {
+ Object exArgs[] = { uri };
+
+ throw new TransformationException(
+ "signature.Transform.ForbiddenTransform", exArgs
+ );
+ }
+ }
/**
* Return the nonnegative number of transformations.
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/implementations/TransformXPath2Filter.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/implementations/TransformXPath2Filter.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/implementations/TransformXPath2Filter.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/implementations/TransformXPath2Filter.java Thu Dec 8 11:56:30 2011
@@ -53,8 +53,6 @@ import org.xml.sax.SAXException;
* Implements the <I>XML Signature XPath Filter v2.0</I>
*
* @see <A HREF="http://www.w3.org/TR/xmldsig-filter2/">XPath Filter v2.0 (TR)</A>
- * @see <a HREF="http://www.w3.org/Signature/Drafts/xmldsig-xfilter2/">XPath Filter v2.0
- * (editors copy)</a>
*/
public class TransformXPath2Filter extends TransformSpi {
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPath2FilterContainer.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPath2FilterContainer.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPath2FilterContainer.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPath2FilterContainer.java Thu Dec 8 11:56:30 2011
@@ -34,7 +34,6 @@ import org.w3c.dom.NodeList;
*
* @author $Author$
* @see <A HREF="http://www.w3.org/TR/xmldsig-filter2/">XPath Filter v2.0 (TR)</A>
- * @see <A HREF="http://www.w3.org/Signature/Drafts/xmldsig-xfilter2/">XPath Filter v2.0 (editors copy)</A>
*/
public class XPath2FilterContainer extends ElementProxy implements TransformParam {
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPath2FilterContainer04.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPath2FilterContainer04.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPath2FilterContainer04.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPath2FilterContainer04.java Thu Dec 8 11:56:30 2011
@@ -33,7 +33,6 @@ import org.w3c.dom.NodeList;
*
* @author $Author$
* @see <A HREF="http://www.w3.org/TR/xmldsig-filter2/">XPath Filter v2.0 (TR)</A>
- * @see <A HREF="http://www.w3.org/Signature/Drafts/xmldsig-xfilter2/">XPath Filter v2.0 (editors copy)</A>
*/
public class XPath2FilterContainer04 extends ElementProxy implements TransformParam {
Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPathFilterCHGPContainer.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPathFilterCHGPContainer.java?rev=1211847&r1=1211846&r2=1211847&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPathFilterCHGPContainer.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/transforms/params/XPathFilterCHGPContainer.java Thu Dec 8 11:56:30 2011
@@ -21,7 +21,6 @@ package org.apache.xml.security.transfor
import org.apache.xml.security.exceptions.XMLSecurityException;
import org.apache.xml.security.transforms.TransformParam;
-import org.apache.xml.security.transforms.Transforms;
import org.apache.xml.security.utils.ElementProxy;
import org.apache.xml.security.utils.XMLUtils;
import org.w3c.dom.Document;
@@ -36,6 +35,9 @@ import org.w3c.dom.Node;
*/
public class XPathFilterCHGPContainer extends ElementProxy implements TransformParam {
+ public static final String TRANSFORM_XPATHFILTERCHGP =
+ "http://www.nue.et-inf.uni-siegen.de/~geuer-pollmann/#xpathFilter";
+
/** Field _ATT_FILTER_VALUE_INTERSECT */
private static final String _TAG_INCLUDE_BUT_SEARCH = "IncludeButSearch";
@@ -305,6 +307,6 @@ public class XPathFilterCHGPContainer ex
* @inheritDoc
*/
public final String getBaseNamespace() {
- return Transforms.TRANSFORM_XPATHFILTERCHGP;
+ return TRANSFORM_XPATHFILTERCHGP;
}
}