[java-metadata-aggregator COMMIT] in /trunk: aggregator-parent/doc/RELEASE-NOTES.txt aggregator-pipeline/src/main/jav...

[noreply at shibboleth.net]

Author: iay
Date: Sun Oct 13 13:57:46 2013
New Revision: 272

URL: http://svn.shibboleth.net/view/java-metadata-aggregator?rev=272&view=rev
Log:
MDA-91: allow checking that SAML metadata is signed using ID, not empty reference

Added:
    trunk/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/dom/XMLSignatureValidationStage-emptyref.xml   (with props)
Modified:
    trunk/aggregator-parent/doc/RELEASE-NOTES.txt
    trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java
    trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidator.java
    trunk/aggregator-pipeline/src/test/java/net/shibboleth/metadata/dom/XMLSignatureValidationStageTest.java

Modified: trunk/aggregator-parent/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-metadata-aggregator/trunk/aggregator-parent/doc/RELEASE-NOTES.txt?rev=272&r1=271&r2=272&view=diff
==============================================================================
--- trunk/aggregator-parent/doc/RELEASE-NOTES.txt (original)
+++ trunk/aggregator-parent/doc/RELEASE-NOTES.txt Sun Oct 13 13:57:46 2013
@@ -3,7 +3,8 @@
 
 Highlights
    * API changes for new Shibboleth coding conventions
-   * Algorithm blacklisting during signature validation
+   * Signature validation can reject empty references, blacklist
+     algorithm URIs and protects against "wrapping" attacks.
    * Moved to Java 7, Apache Santuario V1.5
    * Improved CLI experience
    * bug fixes
@@ -46,6 +47,7 @@
 
 ** New Feature
     * [MDA-88] - assist debugging of signature creation by making pre-digest data available
+    * [MDA-91] - allow checking that SAML metadata is signed using ID, not empty reference
     * [MDA-120] - signature validation stage should allow algorithm blacklisting
 
 ** Task

Modified: trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java
URL: http://svn.shibboleth.net/view/java-metadata-aggregator/trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java?rev=272&r1=271&r2=272&view=diff
==============================================================================
--- trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java (original)
+++ trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java Sun Oct 13 13:57:46 2013
@@ -85,6 +85,9 @@
     /** Set of blacklisted signature method URIs. Default value: empty set. */
     @Nonnull private Set<String> blacklistedSignatureMethods = Collections.emptySet();
     
+    /** Option to determine whether empty references are to be permitted.  Default value: <code>true</code>. */
+    private boolean permittingEmptyReferences = true;
+    
     /** Validator used for all signatures validated by this stage instance. */
     private XMLSignatureValidator validator;
 
@@ -217,6 +220,27 @@
         return Collections.unmodifiableSet(blacklistedSignatureMethods);
     }
 
+    /**
+     * Gets whether empty references are permitted.
+     * 
+     * @return whether empty references are permitted
+     */
+    public boolean isPermittingEmptyReferences() {
+        return permittingEmptyReferences;
+    }
+
+    /**
+     * Sets whether empty references are permitted.
+     * 
+     * @param permit whether empty references are permitted
+     */
+    public synchronized void setPermittingEmptyReferences(final boolean permit) {
+        ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+        permittingEmptyReferences = permit;
+    }
+    
     /** {@inheritDoc} */
     protected boolean doExecute(@Nonnull final DOMElementItem item) throws StageProcessingException {
         
@@ -282,7 +306,8 @@
                     + ", no verification key was specified");
         }
 
-        validator = new XMLSignatureValidator(verificationKey, blacklistedDigests, blacklistedSignatureMethods);
+        validator = new XMLSignatureValidator(verificationKey,
+                blacklistedDigests, blacklistedSignatureMethods, permittingEmptyReferences);
 
         if (!Init.isInitialized()) {
             Init.init();

Modified: trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidator.java
URL: http://svn.shibboleth.net/view/java-metadata-aggregator/trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidator.java?rev=272&r1=271&r2=272&view=diff
==============================================================================
--- trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidator.java (original)
+++ trunk/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidator.java Sun Oct 13 13:57:46 2013
@@ -73,15 +73,20 @@
     /** Set of blacklisted signature methods. */
     private final Set<String> blacklistedSignatureMethods;
     
+    /** Whether an empty reference is permitted. */

[... 119 lines stripped ...]