[java-xmltooling COMMIT] in /branches/REL_1: doc/RELEASE-NOTES.txt src/main/java/org/opensaml/xml/signature/impl/Expl...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Feb 11 11:01:24 2013
New Revision: 789

URL: http://svn.shibboleth.net/view/java-xmltooling?rev=789&view=rev
Log:
JXT-99: Signature verification exception on Java 7

Modified:
    branches/REL_1/doc/RELEASE-NOTES.txt
    branches/REL_1/src/main/java/org/opensaml/xml/signature/impl/ExplicitKeySignatureTrustEngine.java
    branches/REL_1/src/main/java/org/opensaml/xml/signature/impl/PKIXSignatureTrustEngine.java

Modified: branches/REL_1/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/doc/RELEASE-NOTES.txt?rev=789&r1=788&r2=789&view=diff
==============================================================================
--- branches/REL_1/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_1/doc/RELEASE-NOTES.txt Mon Feb 11 11:01:24 2013
@@ -4,7 +4,8 @@
 [JXT-88] - AbstractXMLObject unnecessarily creates a new QName in getElementQName
 [JXT-89] - AbstractXMLObjectUnmarshaller should check isTraceEnabled in unmarshall(Element) before *creating* QNames and logging
 [JXT-93] - X509Util.determineEntityCertificate doesn't catch lower layer SecurityException
-[JXT-97] - DigestMethod builder defaults to wrong namespace/prefix 
+[JXT-97] - DigestMethod builder defaults to wrong namespace/prefix
+[JXT-99] - Signature verification exception on Java 7
 
 Changes in Release 1.3.4
 =============================================

Modified: branches/REL_1/src/main/java/org/opensaml/xml/signature/impl/ExplicitKeySignatureTrustEngine.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/main/java/org/opensaml/xml/signature/impl/ExplicitKeySignatureTrustEngine.java?rev=789&r1=788&r2=789&view=diff
==============================================================================
--- branches/REL_1/src/main/java/org/opensaml/xml/signature/impl/ExplicitKeySignatureTrustEngine.java (original)
+++ branches/REL_1/src/main/java/org/opensaml/xml/signature/impl/ExplicitKeySignatureTrustEngine.java Mon Feb 11 11:01:24 2013
@@ -136,15 +136,20 @@
 
         // First try the optional supplied candidate credential
         if (candidateCredential != null) {
-            if (SigningUtil.verifyWithURI(candidateCredential, algorithmURI, signature, content)) {
-                log.debug("Successfully verified signature using supplied candidate credential");
-                log.debug("Attempting to establish trust of supplied candidate credential");
-                if (evaluateTrust(candidateCredential, trustedCredentials)) {
-                    log.debug("Successfully established trust of supplied candidate credential");
-                    return true;
-                } else {
-                    log.debug("Failed to establish trust of supplied candidate credential");
+            try {
+                if (SigningUtil.verifyWithURI(candidateCredential, algorithmURI, signature, content)) {
+                    log.debug("Successfully verified signature using supplied candidate credential");
+                    log.debug("Attempting to establish trust of supplied candidate credential");
+                    if (evaluateTrust(candidateCredential, trustedCredentials)) {
+                        log.debug("Successfully established trust of supplied candidate credential");
+                        return true;
+                    } else {
+                        log.debug("Failed to establish trust of supplied candidate credential");
+                    }
                 }
+            } catch (SecurityException e) {
+                // Java 7 now throws this exception under conditions such as mismatched key sizes.
+                // Swallow this, it's logged by the verifyWithURI method already.
             }
         }
 
@@ -154,9 +159,14 @@
         log.debug("Attempting to verify signature using trusted credentials");
 
         for (Credential trustedCredential : trustedCredentials) {
-            if (SigningUtil.verifyWithURI(trustedCredential, algorithmURI, signature, content)) {
-                log.debug("Successfully verified signature using resolved trusted credential");
-                return true;
+            try {
+                if (SigningUtil.verifyWithURI(trustedCredential, algorithmURI, signature, content)) {
+                    log.debug("Successfully verified signature using resolved trusted credential");
+                    return true;
+                }
+            } catch (SecurityException e) {
+                // Java 7 now throws this exception under conditions such as mismatched key sizes.
+                // Swallow this, it's logged by the verifyWithURI method already.
             }
         }
         log.debug("Failed to verify signature using either supplied candidate credential"

Modified: branches/REL_1/src/main/java/org/opensaml/xml/signature/impl/PKIXSignatureTrustEngine.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/main/java/org/opensaml/xml/signature/impl/PKIXSignatureTrustEngine.java?rev=789&r1=788&r2=789&view=diff
==============================================================================

[... 35 lines stripped ...]