[java-metadata-aggregator COMMIT] in /trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom: XMLSignatu...

[noreply at shibboleth.net]

Author: iay
Date: Sat Oct 12 12:14:42 2013
New Revision: 266

URL: http://svn.shibboleth.net/view/java-metadata-aggregator?rev=266&view=rev
Log:
MDA-112 signature validation stage should protect against wrapping attacks
Replace most of the validation logic used in the validation stage with a port of the equivalent code from the XmlSecTool application, encapsulated in a hopefully reusable class.

Added:
    trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidator.java   (with props)
Modified:
    trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java

Modified: trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java
URL: http://svn.shibboleth.net/view/java-metadata-aggregator/trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java?rev=266&r1=265&r2=266&view=diff
==============================================================================
--- trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java (original)
+++ trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java Sat Oct 12 12:14:42 2013
@@ -19,7 +19,6 @@
 
 import java.security.PublicKey;
 import java.security.cert.Certificate;
-import java.util.List;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -27,18 +26,15 @@
 
 import net.shibboleth.metadata.ErrorStatus;
 import net.shibboleth.metadata.WarningStatus;
+import net.shibboleth.metadata.dom.XMLSignatureValidator.ValidationException;
 import net.shibboleth.metadata.pipeline.BaseIteratingStage;
 import net.shibboleth.metadata.pipeline.StageProcessingException;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.xml.ElementSupport;
 import net.shibboleth.utilities.java.support.xml.SerializeSupport;
 
 import org.apache.xml.security.Init;
-import org.apache.xml.security.exceptions.XMLSecurityException;
-import org.apache.xml.security.signature.XMLSignature;
-import org.apache.xml.security.signature.XMLSignatureException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.w3c.dom.Element;
@@ -76,6 +72,9 @@
 
     /** Public key used to verify the Element signature. */
     private PublicKey verificationKey;
+    
+    /** Validator used for all signatures validated by this stage instance. */
+    private XMLSignatureValidator validator;
 
     /**
      * Gets whether the Element is required to be signed.
@@ -165,16 +164,27 @@
 
     /** {@inheritDoc} */
     protected boolean doExecute(@Nonnull final DomElementItem item) throws StageProcessingException {
-        final Element signatureElement = getSignatureElement(item.unwrap());
-        if (signatureElement == null) {
-            if (signatureRequired) {
-                log.debug("DOM Element was not signed and signature is required");
-                item.getItemMetadata().put(
-                        new ErrorStatus(getId(), "DOM Element was not signed but signatures are required"));
-            } else {
-                log.debug("DOM Element is not signed, no verification performed");
+        
+        final Element docElement = item.unwrap();
+        
+        // Step 1: locate the signature element within the document.
+        Element signatureElement;
+        try {
+            signatureElement = validator.getSignatureElement(docElement);
+            if (signatureElement == null) {
+                if (signatureRequired) {
+                    log.debug("DOM Element was not signed and signature is required");
+                    item.getItemMetadata().put(
+                            new ErrorStatus(getId(), "DOM Element was not signed but signatures are required"));
+                } else {
+                    log.debug("DOM Element is not signed, no verification performed");
+                }
+                return true;
             }
-
+        } catch (ValidationException e) {
+            // pass on an error from signature location (e.g., multiple signatures)
+            log.debug("setting status: ", e.getMessage());
+            item.getItemMetadata().put(new ErrorStatus(getId(), e.getMessage()));
             return true;
         }
 
@@ -182,80 +192,26 @@
             log.debug("DOM Element contained Signature element\n{}", SerializeSupport.prettyPrintXML(signatureElement));
         }
 
-        if (!signatureVerified(signatureElement)) {
+        try {
+            validator.verifySignature(docElement, signatureElement);
+        } catch (ValidationException e) {
+            final String message = "element signature is invalid: " + e.getMessage();
+            log.debug("setting status: ", message);
             if (validSignatureRequired) {

[... 89 lines stripped ...]