[utilities COMMIT] in /xmlsectool/trunk: doc/RELEASE-NOTES.txt src/main/java/edu/internet2/middleware/security/XmlSec...

[noreply at shibboleth.net]

Author: iay
Date: Mon Mar 18 06:48:45 2013
New Revision: 359

URL: http://svn.shibboleth.net/view/utilities?rev=359&view=rev
Log:
[XSTJ-28] - provide blacklist ability for SHA-1 during signature verification

Added:
    xmlsectool/trunk/src/test/resources/manual/XSTJ-28/
    xmlsectool/trunk/src/test/resources/manual/XSTJ-28/original.xml   (with props)
    xmlsectool/trunk/src/test/resources/manual/XSTJ-28/readme.md
    xmlsectool/trunk/src/test/resources/manual/XSTJ-28/sha1.xml   (with props)
Modified:
    xmlsectool/trunk/doc/RELEASE-NOTES.txt
    xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java
    xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java

Modified: xmlsectool/trunk/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/utilities/xmlsectool/trunk/doc/RELEASE-NOTES.txt?rev=359&r1=358&r2=359&view=diff
==============================================================================
--- xmlsectool/trunk/doc/RELEASE-NOTES.txt (original)
+++ xmlsectool/trunk/doc/RELEASE-NOTES.txt Mon Mar 18 06:48:45 2013
@@ -2,6 +2,7 @@
 =============================================
 [XSTJ-38] - blacklist MD5 algorithm during signature verification
 [XSTJ-31] - add ECDSA elliptic curve signature support
+[XSTJ-28] - provide blacklist ability for SHA-1 during signature verification
 [XSTJ-27] - compatibility with Apache Santuario 1.5.x
 [XSTJ-24] - should not use xmlsec IdResolver class
 [XSTJ-22] - non-zero exit codes from shell script

Modified: xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java
URL: http://svn.shibboleth.net/view/utilities/xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java?rev=359&r1=358&r2=359&view=diff
==============================================================================
--- xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java (original)
+++ xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java Mon Mar 18 06:48:45 2013
@@ -143,6 +143,9 @@
         if (cli.doClearBlacklist()) {
             cli.getBlacklist().clear();
         }
+        for (XmlSecToolCommandLineArguments.DigestChoice dig: cli.getBlacklistDigests()) {
+            cli.getBlacklist().addDigest(dig);
+        }
         if (cli.doListBlacklist()) {
             System.out.println("Digest algorithm blacklist:");
             if (cli.getBlacklist().getDigestBlacklist().isEmpty()) {

Modified: xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java
URL: http://svn.shibboleth.net/view/utilities/xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java?rev=359&r1=358&r2=359&view=diff
==============================================================================
--- xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java (original)
+++ xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java Mon Mar 18 06:48:45 2013
@@ -21,11 +21,13 @@
 import jargs.gnu.CmdLineParser.OptionException;
 
 import java.io.PrintStream;
+import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
 import java.util.Set;
 import java.util.TreeSet;
+import java.util.Vector;
 
 import org.opensaml.xml.encryption.EncryptionConstants;
 import org.opensaml.xml.signature.SignatureConstants;
@@ -55,9 +57,39 @@
          * Initializes the blacklist with those algorithms that should be
          * blacklisted by default.
          */
-        protected Blacklist() {
-            digestBlacklist.add(SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5);
-            signatureBlacklist.add(SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5);
+        public Blacklist() {
+            addDigestAlgorithm(SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5);
+            addSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5);
+        }
+        
+        /**
+         * Blacklist an individual digest algorithm.
+         * 
+         * @param uri algorithm URI to blacklist
+         */
+        private void addDigestAlgorithm(String uri) {
+            digestBlacklist.add(uri);
+        }
+        
+        /**
+         * Blacklist an individual signature algorithm.
+         * 
+         * @param uri algorithm URI to blacklist
+         */
+        private void addSignatureAlgorithm(String uri) {
+            signatureBlacklist.add(uri);
+        }
+        
+        /**
+         * Blacklist the digest and signature algorithms associated with
+         * a {@link DigestChoice}.
+         * 
+         * @param digestChoice {@DigestChoice} to add to blacklist
+         */
+        public void addDigest(DigestChoice digestChoice) {
+            addDigestAlgorithm(digestChoice.getDigestAlgorithm());
+            addSignatureAlgorithm(digestChoice.getRsaAlgorithm());

[... 117 lines stripped ...]