[java-opensaml COMMIT] in /trunk/opensaml-saml-impl/src: main/java/org/opensaml/saml/metadata/resolver/filter/impl/Si...

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Nov  6 18:36:38 2015
New Revision: 4399

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4399&view=rev
Log:
OSJ-121: On SignatureValidationFilter consider change to behavior on signature failure of root element

Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java
    trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java
    trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterPKIXTest.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java?rev=4399&r1=4398&r2=4399&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java	(original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java	Fri Nov  6 18:36:38 2015
@@ -204,16 +204,24 @@
 
         if (!signableMetadata.isSigned()){
             if (getRequireSignature()) {
-                throw new FilterException("Metadata root element was unsigned and signatures are required.");
-            }
-        }
-        
-        if (signableMetadata instanceof EntityDescriptor) {
-            processEntityDescriptor((EntityDescriptor) signableMetadata);
-        } else if (signableMetadata instanceof EntitiesDescriptor) {
-            processEntityGroup((EntitiesDescriptor) signableMetadata);
-        } else {
-            log.error("Internal error, metadata object was of an unsupported type: {}", metadata.getClass().getName());
+                log.warn("Metadata root element was unsigned and signatures are required, " 
+                        + "metadata will be filtered out.");
+                return null;
+            }
+        }
+        
+        try {
+            if (signableMetadata instanceof EntityDescriptor) {
+                processEntityDescriptor((EntityDescriptor) signableMetadata);
+            } else if (signableMetadata instanceof EntitiesDescriptor) {
+                processEntityGroup((EntitiesDescriptor) signableMetadata);
+            } else {
+                log.error("Internal error, metadata object was of an unsupported type: {}", 
+                        metadata.getClass().getName());
+            }
+        } catch (Throwable t) {
+            log.warn("Saw fatal error validating metadata signature(s), metadata will be filtered out", t);
+            return null;
         }
         
         return metadata;

Modified: trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java?rev=4399&r1=4398&r2=4399&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java	(original)
+++ trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java	Fri Nov  6 18:36:38 2015
@@ -124,7 +124,7 @@
         }
     }
     
-    @Test(expectedExceptions=FilterException.class)
+    @Test
     public void testSWITCHStandaloneBlacklistedSignatureAlgorithm() throws UnmarshallingException, FilterException {
         XMLObject xmlObject = unmarshallerFactory.getUnmarshaller(switchMDDocumentValid
                 .getDocumentElement()).unmarshall(switchMDDocumentValid.getDocumentElement());
@@ -136,21 +136,18 @@
         CriteriaSet defaultCriteriaSet = new CriteriaSet(new SignatureValidationParametersCriterion(sigParams));
         filter.setDefaultCriteria(defaultCriteriaSet);
         
-        filter.filter(xmlObject);
-    }
-    
-    @Test
-    public void testInvalidSWITCHStandalone() throws UnmarshallingException {
+        XMLObject filtered = filter.filter(xmlObject);
+        Assert.assertNull(filtered);
+    }
+    
+    @Test
+    public void testInvalidSWITCHStandalone() throws UnmarshallingException, FilterException {
         XMLObject xmlObject = unmarshallerFactory.getUnmarshaller(switchMDDocumentInvalid
                 .getDocumentElement()).unmarshall(switchMDDocumentInvalid.getDocumentElement());
         
         SignatureValidationFilter filter = new SignatureValidationFilter(switchSigTrustEngine);
-        try {
-            filter.filter(xmlObject);
-            Assert.fail("Filter passed validation, should have failed");

[... 83 lines stripped ...]