[xmlsectool] 01/04: XSTJ-39 - add SHA-1 to the default verification blacklist

[Ian Young]

This is an automated email from the git hooks/post-receive script.

iay pushed a commit to branch master
in repository xmlsectool.

commit 64c96eaac6813c0417e87eb2503cece2addab2c9
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Thu Apr 28 15:30:18 2016 +0100

    XSTJ-39 - add SHA-1 to the default verification blacklist
---
 .../xmlsectool/XmlSecToolCommandLineArguments.java  |  4 ++++
 .../XmlSecToolCommandLineArgumentsTest.java         | 21 ++++++++++++++++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecToolCommandLineArguments.java b/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecToolCommandLineArguments.java
index f702371..fbb13f2 100644
--- a/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecToolCommandLineArguments.java
+++ b/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecToolCommandLineArguments.java
@@ -57,8 +57,12 @@ public class XmlSecToolCommandLineArguments {
          * blacklisted by default.
          */
         public Blacklist() {
+            // MD5
             addDigestAlgorithm(SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5);
             addSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5);
+            
+            // SHA-1
+            addDigest(DigestChoice.SHA1);
         }
         
         /**
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/XmlSecToolCommandLineArgumentsTest.java b/src/test/java/net/shibboleth/tool/xmlsectool/XmlSecToolCommandLineArgumentsTest.java
index a896e01..2c5e92e 100644
--- a/src/test/java/net/shibboleth/tool/xmlsectool/XmlSecToolCommandLineArgumentsTest.java
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/XmlSecToolCommandLineArgumentsTest.java
@@ -1,14 +1,16 @@
 package net.shibboleth.tool.xmlsectool;
 
+import org.opensaml.xml.signature.SignatureConstants;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
+import net.shibboleth.tool.xmlsectool.XmlSecToolCommandLineArguments.Blacklist;
 import net.shibboleth.tool.xmlsectool.XmlSecToolCommandLineArguments.DigestChoice;
 
 public class XmlSecToolCommandLineArgumentsTest {
 
 	@Test
-	public void xstj34_sign_with_SHA256() throws Exception{
+	public void xstj34_sign_with_SHA256() throws Exception {
 		final String[] args = {
 				"--sign",
 				"--inFile", "in.xml",
@@ -22,4 +24,21 @@ public class XmlSecToolCommandLineArgumentsTest {
 		Assert.assertNotNull(digest);
 		Assert.assertSame(digest, DigestChoice.SHA256);
 	}
+	
+	@Test
+	public void xstj39_default_blacklist_SHA1() throws Exception {
+		final String[] args = {
+				"--sign",
+				"--inFile", "in.xml",
+				"--outFile", "out.xml",
+				"--certificate", "example.crt",
+				"--key", "example.key"
+				};
+		final XmlSecToolCommandLineArguments cli = new XmlSecToolCommandLineArguments();
+		cli.parseCommandLineArguments(args);
+		final Blacklist blacklist = cli.getBlacklist();
+		Assert.assertTrue(blacklist.isBlacklistedDigest(SignatureConstants.ALGO_ID_DIGEST_SHA1));
+		Assert.assertTrue(blacklist.isBlacklistedSignature(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
+		Assert.assertTrue(blacklist.isBlacklistedSignature(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA1));
+	}
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.