[utilities COMMIT] in /xmlsectool/trunk: doc/RELEASE-NOTES.txt src/main/java/edu/internet2/middleware/security/XmlSec...

[noreply at shibboleth.net]

Author: iay
Date: Thu Mar  7 08:34:34 2013
New Revision: 341

URL: http://svn.shibboleth.net/view/utilities?rev=341&view=rev
Log:
[XSTJ-24] - should not use xmlsec IdResolver class

Modified:
    xmlsectool/trunk/doc/RELEASE-NOTES.txt
    xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java

Modified: xmlsectool/trunk/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/utilities/xmlsectool/trunk/doc/RELEASE-NOTES.txt?rev=341&r1=340&r2=341&view=diff
==============================================================================
--- xmlsectool/trunk/doc/RELEASE-NOTES.txt (original)
+++ xmlsectool/trunk/doc/RELEASE-NOTES.txt Thu Mar  7 08:34:34 2013
@@ -1,6 +1,7 @@
 Changes in Release 1.2.0
 =============================================
 [XSTJ-27] - compatibility with Apache Santuario 1.5.x
+[XSTJ-24] - should not use xmlsec IdResolver class
 [XSTJ-22] - non-zero exit codes from shell script
 [XSTJ-17] - multiple errors in --help documentation
 [XSTJ-16] - misleading error message on failed schema validation

Modified: xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java
URL: http://svn.shibboleth.net/view/utilities/xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java?rev=341&r1=340&r2=341&view=diff
==============================================================================
--- xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java (original)
+++ xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java Thu Mar  7 08:34:34 2013
@@ -61,10 +61,11 @@
 import org.apache.xml.security.signature.Reference;
 import org.apache.xml.security.signature.XMLSignature;
 import org.apache.xml.security.signature.XMLSignatureException;
+import org.apache.xml.security.signature.reference.ReferenceData;
+import org.apache.xml.security.signature.reference.ReferenceSubTreeData;
 import org.apache.xml.security.transforms.Transform;
 import org.apache.xml.security.transforms.TransformationException;
 import org.apache.xml.security.transforms.Transforms;
-import org.apache.xml.security.utils.IdResolver;
 import org.opensaml.ws.soap.client.http.HttpClientBuilder;
 import org.opensaml.ws.soap.client.http.TLSProtocolSocketFactory;
 import org.opensaml.xml.schema.SchemaBuilder;
@@ -630,12 +631,21 @@
 
         final Reference ref = extractReference(signature);
         markIdAttribute(xmlDocument.getDocumentElement(), ref);
-        validateSignatureReference(xmlDocument, ref);
 
         Key verificationKey = SecurityHelper.extractVerificationKey(getCredential(cli));
         log.debug("Verifying XML signature with key\n{}", Base64.encodeBytes(verificationKey.getEncoded()));
         try {
             if (signature.checkSignatureValue(verificationKey)) {
+                /*
+                 * Now that the signature has been verified, we need to check that the
+                 * XML signature layer resolved the reference to the correct element
+                 * (always the document element) and that only appropriate transforms have
+                 * been applied.
+                 * 
+                 * Note that we need to re-extract the reference from the signature at
+                 * this point, we can't use one from before the signature validation.
+                 */
+                validateSignatureReference(xmlDocument, extractReference(signature));
                 log.info("XML document signature verified.");
             } else {
                 log.error("XML document signature verification failed");
@@ -678,7 +688,6 @@
     /**
      * Validates the reference within the XML signature by performing the following checks.
      * <ul>
-     * <li>check that there is only one reference</li>
      * <li>check that the XML signature layer resolves that reference to the same element as the DOM layer does</li>
      * <li>check that only enveloped and, optionally, exclusive canonicalization transforms are used</li>
      * </ul>
@@ -692,37 +701,31 @@
     }
 
     /**
-     * Validates that the element resolved by the signature validation layer's {@link IdResolver} is the same as the
+     * Validates that the element resolved by the signature validation layer is the same as the
      * element resolved by the DOM layer.
      * 
      * @param xmlDocument the signed document
      * @param reference the reference to be validated
      */
     protected static void validateSignatureReferenceUri(Document xmlDocument, Reference reference) {
-        String referenceUri = reference.getURI();
-        if (!DatatypeHelper.isEmpty(referenceUri)) {
-            if (!referenceUri.startsWith("#")) {
-                log.error("Signature Reference URI was not a document fragment reference: " + referenceUri);
+        final ReferenceData refData = reference.getReferenceData();
+        if (refData instanceof ReferenceSubTreeData) {
+            final ReferenceSubTreeData subTree = (ReferenceSubTreeData) refData;
+            final Node root = subTree.getRoot();
+            Node resolvedSignedNode = root;

[... 34 lines stripped ...]