[java-opensaml COMMIT] in /trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl: Expli...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Feb 22 22:54:20 2013
New Revision: 3223

URL: http://svn.shibboleth.net/view/java-opensaml?rev=3223&view=rev
Log:
OSJ-28: port r789

Modified:
    trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngine.java
    trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngine.java

Modified: trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngine.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngine.java?rev=3223&r1=3222&r2=3223&view=diff
==============================================================================
--- trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngine.java (original)
+++ trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngine.java Fri Feb 22 22:54:20 2013
@@ -155,15 +155,20 @@
 
         // First try the optional supplied candidate credential
         if (candidateCredential != null) {
-            if (XMLSigningUtil.verifyWithURI(candidateCredential, algorithmURI, signature, content)) {
-                log.debug("Successfully verified signature using supplied candidate credential");
-                log.debug("Attempting to establish trust of supplied candidate credential");
-                if (evaluateTrust(candidateCredential, trustedCredentials)) {
-                    log.debug("Successfully established trust of supplied candidate credential");
-                    return true;
-                } else {
-                    log.debug("Failed to establish trust of supplied candidate credential");
+            try {
+                if (XMLSigningUtil.verifyWithURI(candidateCredential, algorithmURI, signature, content)) {
+                    log.debug("Successfully verified signature using supplied candidate credential");
+                    log.debug("Attempting to establish trust of supplied candidate credential");
+                    if (evaluateTrust(candidateCredential, trustedCredentials)) {
+                        log.debug("Successfully established trust of supplied candidate credential");
+                        return true;
+                    } else {
+                        log.debug("Failed to establish trust of supplied candidate credential");
+                    }
                 }
+            } catch (SecurityException e) {
+                // Java 7 now throws this exception under conditions such as mismatched key sizes.
+                // Swallow this, it's logged by the verifyWithURI method already.
             }
         }
 
@@ -173,9 +178,14 @@
         log.debug("Attempting to verify signature using trusted credentials");
 
         for (Credential trustedCredential : trustedCredentials) {
-            if (XMLSigningUtil.verifyWithURI(trustedCredential, algorithmURI, signature, content)) {
-                log.debug("Successfully verified signature using resolved trusted credential");
-                return true;
+            try {
+                if (XMLSigningUtil.verifyWithURI(trustedCredential, algorithmURI, signature, content)) {
+                    log.debug("Successfully verified signature using resolved trusted credential");
+                    return true;
+                }
+            } catch (SecurityException e) {
+                // Java 7 now throws this exception under conditions such as mismatched key sizes.
+                // Swallow this, it's logged by the verifyWithURI method already.
             }
         }
         log.debug("Failed to verify signature using either supplied candidate credential"

Modified: trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngine.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngine.java?rev=3223&r1=3222&r2=3223&view=diff
==============================================================================
--- trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngine.java (original)
+++ trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngine.java Fri Feb 22 22:54:20 2013
@@ -179,17 +179,22 @@
         Pair<Set<String>, Iterable<PKIXValidationInformation>> validationPair = 
             resolveValidationInfo(trustBasisCriteria);
 
-        if (XMLSigningUtil.verifyWithURI(candidateCredential, algorithmURI, signature, content)) {
-            log.debug("Successfully verified raw signature using supplied candidate credential");
-            log.debug("Attempting to establish trust of supplied candidate credential");
-            if (evaluateTrust(candidateCredential, validationPair)) {

[... 25 lines stripped ...]