[java-opensaml COMMIT] in /trunk: opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter....

[noreply at shibboleth.net]

Author: putmanb
Date: Tue Sep 23 21:58:48 2014
New Revision: 4058

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4058&view=rev
Log:
OSJ-90: In Decrypter, on decryption of EncryptedKey, implement whitelist/blacklist validation of RSA OAEP digest method and MGF algorithms.   

Modified:
    trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java
    trunk/opensaml-xmlsec-impl/pom.xml
    trunk/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/SimpleDecryptionTest.java

Modified: trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java?rev=4058&r1=4057&r2=4058&view=diff
==============================================================================
--- trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java (original)
+++ trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java Tue Sep 23 21:58:48 2014
@@ -65,6 +65,7 @@
 import org.opensaml.xmlsec.encryption.EncryptedKey;
 import org.opensaml.xmlsec.encryption.EncryptedType;
 import org.opensaml.xmlsec.encryption.EncryptionMethod;
+import org.opensaml.xmlsec.encryption.MGF;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCriterion;
 import org.opensaml.xmlsec.signature.DigestMethod;
@@ -572,7 +573,7 @@
             throw new DecryptionException("EncryptedData of unsupported type was encountered");
         }        
 
-        validateAlgorithmURI(encryptedData.getEncryptionMethod().getAlgorithm());
+        validateAlgorithms(encryptedData);
         
         try {
             checkAndMarshall(encryptedData);
@@ -674,7 +675,7 @@
             throw new DecryptionException("Algorithm of encrypted key not supplied, key decryption cannot proceed.");
         }
         
-        validateAlgorithmURI(encryptedKey.getEncryptionMethod().getAlgorithm());
+        validateAlgorithms(encryptedKey);
 
         try {
             checkAndMarshall(encryptedKey);
@@ -1019,6 +1020,56 @@
     }
     
     /**
+     * Validate the algorithms contained within an {@link EncryptedKey}.
+     * 
+     * @param encryptedKey the encrypted key instance to validate
+     * @throws DecryptionException if any algorithms do not satisfy whitelist/blacklist policy
+     */
+    protected void validateAlgorithms(@Nonnull final EncryptedKey encryptedKey) throws DecryptionException {
+        String encryptionAlgorithm = encryptedKey.getEncryptionMethod().getAlgorithm();
+        validateAlgorithmURI(encryptionAlgorithm);
+        
+        if (AlgorithmSupport.isRSAOAEP(encryptionAlgorithm)) {
+            // ds:DigestMethod
+            String digestAlgorithm = null;
+            List<XMLObject> digestMethods = encryptedKey.getEncryptionMethod()
+                    .getUnknownXMLObjects(DigestMethod.DEFAULT_ELEMENT_NAME);
+            if (digestMethods.size() > 0) {
+                DigestMethod digestMethod = (DigestMethod) digestMethods.get(0);
+                digestAlgorithm = StringSupport.trimOrNull(digestMethod.getAlgorithm());
+            }
+            if (digestAlgorithm == null) {
+                // This is the implicit default per XML Encryption
+                digestAlgorithm = SignatureConstants.ALGO_ID_DIGEST_SHA1;
+            }
+            validateAlgorithmURI(digestAlgorithm);
+            
+            // xenc11:MGF
+            String mgfAlgorithm = null;
+            List<XMLObject> mgfs = encryptedKey.getEncryptionMethod().getUnknownXMLObjects(MGF.DEFAULT_ELEMENT_NAME);
+            if (mgfs.size() > 0) {
+                MGF mgf = (MGF) mgfs.get(0);
+                mgfAlgorithm = StringSupport.trimOrNull(mgf.getAlgorithm());
+            }
+            if (mgfAlgorithm == null) {
+                // This is the implicit default per XML Encryption
+                mgfAlgorithm = EncryptionConstants.ALGO_ID_MGF1_SHA1;
+            }
+            validateAlgorithmURI(mgfAlgorithm);
+        }
+    }
+
+    /**
+     * Validate the algorithms contained within an {@link EncryptedData}.
+     * 
+     * @param encryptedData the encrypted data instance to validate
+     * @throws DecryptionException if any algorithms do not satisfy whitelist/blacklist policy
+     */
+    protected void validateAlgorithms(@Nonnull final EncryptedData encryptedData) throws DecryptionException {
+        validateAlgorithmURI(encryptedData.getEncryptionMethod().getAlgorithm());
+    }
+    
+    /**
      * Validate the supplied algorithm URI against the configured whitelist and blacklist.
      * 
      * @param algorithmURI the algorithm URI to evaluate

Modified: trunk/opensaml-xmlsec-impl/pom.xml
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-impl/pom.xml?rev=4058&r1=4057&r2=4058&view=diff
==============================================================================

[... 317 lines stripped ...]