[java-metadata-aggregator COMMIT] in /trunk: aggregator-parent/doc/RELEASE-NOTES.txt aggregator-pipeline/src/main/jav...

[noreply at shibboleth.net]

Author: iay
Date: Sun Oct 13 09:56:57 2013
New Revision: 269

URL: http://svn.shibboleth.net/view/java-metadata-aggregator?rev=269&view=rev
Log:
MDA-120: signature validation stage should allow algorithm blacklisting

Modified:
    trunk/aggregator-parent/doc/RELEASE-NOTES.txt
    trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java
    trunk/aggregator-pipeline/src/test/java/net/shibboleth/metadata/dom/XMLSignatureValidationStageTest.java

Modified: trunk/aggregator-parent/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-metadata-aggregator/trunk/aggregator-parent/doc/RELEASE-NOTES.txt?rev=269&r1=268&r2=269&view=diff
==============================================================================
--- trunk/aggregator-parent/doc/RELEASE-NOTES.txt (original)
+++ trunk/aggregator-parent/doc/RELEASE-NOTES.txt Sun Oct 13 09:56:57 2013
@@ -3,6 +3,10 @@
 
 Highlights
    * API changes for new Shibboleth coding conventions
+   * Algorithm blacklisting during signature validation
+   * Moved to Java 7, Apache Santuario V1.5
+   * Improved CLI experience
+   * bug fixes
 
    
 API Changes
@@ -41,6 +45,7 @@
 
 ** New Feature
     * [MDA-88] - assist debugging of signature creation by making pre-digest data available
+    * [MDA-120] - signature validation stage should allow algorithm blacklisting
 
 ** Task
     * [MDA-68] - Convert command line interface to use JCommander

Modified: trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java
URL: http://svn.shibboleth.net/view/java-metadata-aggregator/trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java?rev=269&r1=268&r2=269&view=diff
==============================================================================
--- trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java (original)
+++ trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java Sun Oct 13 09:56:57 2013
@@ -19,6 +19,9 @@
 
 import java.security.PublicKey;
 import java.security.cert.Certificate;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Set;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -29,6 +32,7 @@
 import net.shibboleth.metadata.dom.XMLSignatureValidator.ValidationException;
 import net.shibboleth.metadata.pipeline.BaseIteratingStage;
 import net.shibboleth.metadata.pipeline.StageProcessingException;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -38,6 +42,8 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.w3c.dom.Element;
+
+import com.google.common.collect.ImmutableSet;
 
 /**
  * A pipeline stage which validates the XML digital signature found on DOM Elements.
@@ -73,6 +79,12 @@
     /** Public key used to verify the Element signature. */
     private PublicKey verificationKey;
     
+    /** Set of blacklisted digest URIs. Default value: empty set. */
+    @Nonnull private Set<String> blacklistedDigests = Collections.emptySet();
+    
+    /** Set of blacklisted signature method URIs. Default value: empty set. */
+    @Nonnull private Set<String> blacklistedSignatureMethods = Collections.emptySet();
+    
     /** Validator used for all signatures validated by this stage instance. */
     private XMLSignatureValidator validator;
 
@@ -160,6 +172,49 @@
 
         verificationCertificate = Constraint.isNotNull(certificate, "Certificate can not be null");
         verificationKey = verificationCertificate.getPublicKey();
+    }
+    
+    /**
+     * Set the collection of identifiers to be blacklisted as digest algorithms.
+     * 
+     * @param identifiers collection of identifiers to be blacklisted
+     */
+    public void setBlacklistedDigests(@Nonnull @NonnullElements final Collection<String> identifiers) {
+        ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        blacklistedDigests = ImmutableSet.copyOf(Constraint.isNotNull(identifiers,
+                "identifier collection may not be null"));
+    }
+    
+    /**
+     * Gets the set of blacklisted digest algorithm identifiers.
+     * 
+     * @return the set of blacklisted digest algorithm identifiers
+     */
+    @Nonnull @NonnullElements public Set<String> getBlacklistedDigests() {
+        return Collections.unmodifiableSet(blacklistedDigests);
+    }
+
+    /**
+     * Set the collection of identifiers to be blacklisted as signature methods.
+     * 
+     * @param identifiers collection of identifiers to be blacklisted
+     */
+    public void setBlacklistedSignatureMethods(@Nonnull @NonnullElements final Collection<String> identifiers) {

[... 217 lines stripped ...]