[java-opensaml COMMIT] in /trunk/opensaml-xmlsec-api/src: main/java/org/opensaml/xmlsec/crypto/AlgorithmSupport.java ...

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Feb 28 20:53:11 2014
New Revision: 3659

URL: http://svn.shibboleth.net/view/java-opensaml?rev=3659&view=rev
Log:
More work on OSJ-64:  Refactor whitelist/blacklist algorithm eval into support class for reuse.

Modified:
    trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/crypto/AlgorithmSupport.java
    trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java
    trunk/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/crypto/AlgorithmSupportTest.java

Modified: trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/crypto/AlgorithmSupport.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/crypto/AlgorithmSupport.java?rev=3659&r1=3658&r2=3659&view=diff
==============================================================================
--- trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/crypto/AlgorithmSupport.java (original)
+++ trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/crypto/AlgorithmSupport.java Fri Feb 28 20:53:11 2014
@@ -21,6 +21,7 @@
 import java.security.KeyPair;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
+import java.util.Collection;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -49,6 +50,9 @@
  */
 public final class AlgorithmSupport {
     
+    /** Logger. */
+    private static final Logger LOG = LoggerFactory.getLogger(AlgorithmSupport.class);
+    
     /** Additional algorithm URI's which imply RSA keys. */
     private static Set<String> rsaAlgorithmURIs;
 
@@ -217,6 +221,50 @@
     }
     
     /**
+     * Validate the supplied algorithm URI against the specified whitelist and blacklist.
+     * 
+     * @param algorithmURI the algorithm URI to evaluate
+     * @param whitelistedAlgorithmURIs the algorithm whitelist
+     * @param blacklistedAlgorithmURIs the algorithm blacklist
+     * 
+     * @return true if algorithm URI satisfies the specified whitelist and blacklist, otherwise false
+     */
+    public static boolean validateAlgorithmURI(@Nonnull final String algorithmURI, 
+            @Nullable final Collection<String> whitelistedAlgorithmURIs,
+            @Nullable final Collection<String> blacklistedAlgorithmURIs) {
+        
+        if (blacklistedAlgorithmURIs != null) {
+            LOG.debug("Saw non-null algorithm blacklist: {}", blacklistedAlgorithmURIs);
+            if (blacklistedAlgorithmURIs.contains(algorithmURI)) {
+                LOG.warn("Algorithm failed blacklist validation: {}", algorithmURI);
+                return false;
+            } else {
+                LOG.debug("Algorithm passed blacklist validation: {}", algorithmURI);
+            }
+        } else {
+            LOG.debug("Saw null algorithm blacklist, nothing to evaluate");
+        }
+        
+        if (whitelistedAlgorithmURIs != null) {
+            LOG.debug("Saw non-null algorithm whitelist: {}", whitelistedAlgorithmURIs);
+            if (!whitelistedAlgorithmURIs.isEmpty()) {
+                if (!whitelistedAlgorithmURIs.contains(algorithmURI)) {
+                    LOG.warn("Algorithm failed whitelist validation: {}", algorithmURI);
+                    return false;
+                } else {
+                    LOG.debug("Algorithm passed whitelist validation: {}", algorithmURI);
+                }
+            } else {
+               LOG.debug("Non-null algorithm whitelist was empty, skipping evaluation");
+            }
+        } else {
+            LOG.debug("Saw null algorithm whitelist, nothing to evaluate");
+        }
+        
+        return true;
+    }
+    
+    /**
      * Get an SLF4J Logger.
      * 
      * @return a Logger instance

Modified: trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java?rev=3659&r1=3658&r2=3659&view=diff
==============================================================================
--- trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java (original)
+++ trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java Fri Feb 28 20:53:11 2014
@@ -1025,32 +1025,12 @@
      * @throws DecryptionException if the algorithm URI does not satisfy the whitelist/blacklist policy
      */
     protected void validateAlgorithmURI(@Nonnull final String algorithmURI) throws DecryptionException {
-        if (blacklistedAlgorithmURIs != null) {
-            log.debug("Saw non-null algorithm blacklist: {}", blacklistedAlgorithmURIs);
-            if (blacklistedAlgorithmURIs.contains(algorithmURI)) {
-                log.error("Algorithm '{}' failed blacklist validation");
-                throw new DecryptionException("Algorithm failed blacklist validation: " + algorithmURI);
-            } else {
-                log.debug("Algorithm '{}' passed blacklist validation", algorithmURI);

[... 76 lines stripped ...]