svn commit: r1869534 - in /santuario/xml-security-java/trunk/src: main/java/org/apache/xml/security/signature/XMLSignature.java test/java/org/apache/xml/security/test/dom/signature/CreateSignatureTest.java

[co...@apache.org]

Author: coheigea
Date: Fri Nov  8 09:54:50 2019
New Revision: 1869534

URL: http://svn.apache.org/viewvc?rev=1869534&view=rev
Log:
Enforce the name and namespace of a Signature Element

Modified:
    santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/XMLSignature.java
    santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/dom/signature/CreateSignatureTest.java

Modified: santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/XMLSignature.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/XMLSignature.java?rev=1869534&r1=1869533&r2=1869534&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/XMLSignature.java (original)
+++ santuario/xml-security-java/trunk/src/main/java/org/apache/xml/security/signature/XMLSignature.java Fri Nov  8 09:54:50 2019
@@ -502,6 +502,12 @@ public final class XMLSignature extends
         throws XMLSignatureException, XMLSecurityException {
         super(element, baseURI);
 
+        if (!(Constants.SignatureSpecNS.equals(element.getNamespaceURI())
+            && Constants._TAG_SIGNATURE.equals(element.getLocalName()))) {
+            Object[] exArgs = { element.getLocalName() };
+            throw new XMLSignatureException("signature.Verification.InvalidElement", exArgs);
+        }
+
         // check out SignedInfo child
         Element signedInfoElem = XMLUtils.getNextElement(element.getFirstChild());
 

Modified: santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/dom/signature/CreateSignatureTest.java
URL: http://svn.apache.org/viewvc/santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/dom/signature/CreateSignatureTest.java?rev=1869534&r1=1869533&r2=1869534&view=diff
==============================================================================
--- santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/dom/signature/CreateSignatureTest.java (original)
+++ santuario/xml-security-java/trunk/src/test/java/org/apache/xml/security/test/dom/signature/CreateSignatureTest.java Fri Nov  8 09:54:50 2019
@@ -392,6 +392,74 @@ public class CreateSignatureTest {
         }
     }
 
+    @org.junit.jupiter.api.Test
+    public void testWrongSignatureName() throws Exception {
+        PrivateKey privateKey = kp.getPrivate();
+        Document doc = XMLUtils.newDocument();
+        Element root = doc.createElementNS("", "RootElement");
+
+        doc.appendChild(root);
+        root.appendChild(doc.createTextNode("Some simple text\n"));
+
+        Element canonElem =
+            XMLUtils.createElementInSignatureSpace(doc, Constants._TAG_CANONICALIZATIONMETHOD);
+        canonElem.setAttributeNS(
+            null, Constants._ATT_ALGORITHM, Canonicalizer.ALGO_ID_C14N_EXCL_OMIT_COMMENTS
+        );
+
+        SignatureAlgorithm signatureAlgorithm =
+            new SignatureAlgorithm(doc, XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA1);
+        XMLSignature sig =
+            new XMLSignature(doc, null, signatureAlgorithm.getElement(), canonElem);
+        String id = "12345";
+        sig.setId(id);
+
+        ObjectContainer object = new ObjectContainer(doc);
+        SignatureProperties signatureProperties = new SignatureProperties(doc);
+        String sigPropertiesId = "54321";
+        signatureProperties.setId(sigPropertiesId);
+        SignatureProperty signatureProperty = new SignatureProperty(doc, "#" + id);
+        signatureProperties.addSignatureProperty(signatureProperty);
+        object.appendChild(signatureProperties.getElement());
+        signatureProperties.getElement().setIdAttributeNS(null, "Id", true);
+        sig.appendObject(object);
+        sig.addDocument("#" + sigPropertiesId);
+
+        root.appendChild(sig.getElement());
+
+        sig.addKeyInfo(kp.getPublic());
+        sig.sign(privateKey);
+
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+
+        XMLUtils.outputDOMc14nWithComments(doc, bos);
+        String signedContent = new String(bos.toByteArray());
+        // Now change the Signature Element to be "SomeSignature" instead
+        signedContent = signedContent.replaceAll("ds:Signature ", "ds:SomeSignature ");
+        signedContent = signedContent.replaceAll("</ds:Signature>", "</ds:SomeSignature>");
+
+        // Verify the signature
+        Document doc2 = null;
+        try (InputStream is = new ByteArrayInputStream(signedContent.getBytes())) {
+            doc2 = XMLUtils.read(is, false);
+        }
+
+        XPathFactory xpf = XPathFactory.newInstance();
+        XPath xpath = xpf.newXPath();
+        xpath.setNamespaceContext(new DSNamespaceContext());
+
+        String expression = "//ds:SomeSignature[1]";
+        Element sigElement =
+            (Element) xpath.evaluate(expression, doc2, XPathConstants.NODE);
+
+        try {
+            new XMLSignature(sigElement, "");
+            fail("Failure expected on an incorrect Signature element name");
+        } catch (XMLSignatureException ex) {
+            // expected
+        }
+    }
+
     private String doSign() throws Exception {
         PrivateKey privateKey = kp.getPrivate();
         Document doc = XMLUtils.newDocument();