[java-opensaml] branch master updated: OSJ-238: Internal ParserPool built by Decrypter
Brent Putman
putmanb at georgetown.edu
Mon Sep 10 21:09:50 EDT 2018
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=f7ce2de868f75f9b2ac753b3a48d123e7566a923
The following commit(s) were added to refs/heads/master by this push:
new f7ce2de OSJ-238: Internal ParserPool built by Decrypter
f7ce2de is described below
commit f7ce2de868f75f9b2ac753b3a48d123e7566a923
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Mon Sep 10 21:07:00 2018 -0400
OSJ-238: Internal ParserPool built by Decrypter
---
.../xmlsec/config/DecryptionParserPool.java | 54 ++++++++++++++++
.../config/DecryptionParserPoolInitializer.java | 73 ++++++++++++++++++++++
.../xmlsec/encryption/support/Decrypter.java | 29 +++------
.../services/org.opensaml.core.config.Initializer | 3 +-
4 files changed, 137 insertions(+), 22 deletions(-)
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/DecryptionParserPool.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/DecryptionParserPool.java
new file mode 100644
index 0000000..c896b6d
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/DecryptionParserPool.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.config;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.core.config.ConfigurationService;
+
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.xml.ParserPool;
+
+/**
+ * A wrapper bean containing an instance of {@link ParserPool} used with XML decryption
+ * that can be registered with the global {@link ConfigurationService}.
+ */
+public class DecryptionParserPool {
+
+ /** The wrapped parser pool instance. */
+ private ParserPool parserPool;
+
+ /**
+ * Constructor.
+ *
+ * @param pool the parser pool instance
+ */
+ public DecryptionParserPool(@Nonnull final ParserPool pool) {
+ parserPool = Constraint.isNotNull(pool, "Decryption ParserPool may not be null");
+ }
+
+ /**
+ * Obtain the wrapped parser pool instance.
+ *
+ * @return the wrapped parser pool instance
+ */
+ @Nonnull public ParserPool getParserPool() {
+ return parserPool;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/DecryptionParserPoolInitializer.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/DecryptionParserPoolInitializer.java
new file mode 100644
index 0000000..6ba8332
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/DecryptionParserPoolInitializer.java
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.config;
+
+import java.util.HashMap;
+
+import org.opensaml.core.config.ConfigurationService;
+import org.opensaml.core.config.InitializationException;
+import org.opensaml.core.config.Initializer;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.xml.BasicParserPool;
+
+/**
+ * An initializer for the global parser pool for XML decryption use, wrapped by {@link DecryptionParserPool}.
+ *
+ * <p>
+ * The ParserPool configured by default here is an instance of
+ * {@link BasicParserPool}, with a maxPoolSize property of 50,
+ * an additional feature added specifically for decryption usage
+ * (http://apache.org/xml/features/dom/defer-node-expansion = False)
+ * and all other properties with default values.
+ * </p>
+ *
+ */
+public class DecryptionParserPoolInitializer implements Initializer {
+
+ /** Logger. */
+ private Logger log = LoggerFactory.getLogger(DecryptionParserPoolInitializer.class);
+
+ /** {@inheritDoc} */
+ public void init() throws InitializationException {
+ final BasicParserPool pp = new BasicParserPool();
+ pp.setMaxPoolSize(50);
+
+ // Start with a clone of the default pool features
+ // Mostly importantly this includes the existing features for hardening against known
+ // security issues.
+ final HashMap<String, Boolean> features = new HashMap<>(pp.getBuilderFeatures());
+
+ // Add decryption-specific feature.
+ // Note: this feature config is necessary due to an unresolved Xerces deferred DOM issue/bug
+ features.put("http://apache.org/xml/features/dom/defer-node-expansion", Boolean.FALSE);
+
+ pp.setBuilderFeatures(features);
+
+ try {
+ pp.initialize();
+ } catch (final ComponentInitializationException e) {
+ throw new InitializationException("Error initializing parser pool", e);
+ }
+
+ ConfigurationService.register(DecryptionParserPool.class, new DecryptionParserPool(pp));
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java
index ead3f66..3d2152f 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java
@@ -45,6 +45,7 @@ import net.shibboleth.utilities.java.support.xml.XMLParserException;
import org.apache.xml.security.Init;
import org.apache.xml.security.encryption.XMLCipher;
import org.apache.xml.security.encryption.XMLEncryptionException;
+import org.opensaml.core.config.ConfigurationService;
import org.opensaml.core.xml.XMLObject;
import org.opensaml.core.xml.XMLRuntimeException;
import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
@@ -61,6 +62,7 @@ import org.opensaml.security.criteria.KeyLengthCriterion;
import org.opensaml.security.criteria.UsageCriterion;
import org.opensaml.xmlsec.DecryptionParameters;
import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
+import org.opensaml.xmlsec.config.DecryptionParserPool;
import org.opensaml.xmlsec.encryption.EncryptedData;
import org.opensaml.xmlsec.encryption.EncryptedKey;
import org.opensaml.xmlsec.encryption.EncryptedType;
@@ -980,29 +982,14 @@ public class Decrypter {
* </p>
*
* @return a new parser pool instance
+ *
+ * @deprecated
*/
protected ParserPool buildParserPool() {
- final BasicParserPool pp = new BasicParserPool();
- final HashMap<String, Boolean> features = new HashMap<>();
-
- pp.setNamespaceAware(true);
-
- // Note: this feature config is necessary due to an unresolved Xerces deferred DOM issue/bug
- features.put("http://apache.org/xml/features/dom/defer-node-expansion", Boolean.FALSE);
-
- // The following config is to harden the parser pool against known XML security vulnerabilities
- pp.setExpandEntityReferences(false);
- features.put(XMLConstants.FEATURE_SECURE_PROCESSING, true);
- features.put("http://apache.org/xml/features/disallow-doctype-decl", true);
-
- pp.setBuilderFeatures(features);
-
- try {
- pp.initialize();
- return pp;
- } catch (final ComponentInitializationException e) {
- throw new XMLRuntimeException("Problem initializing Decrypter internal ParserPool", e);
- }
+ // Note: we don't really build this here anymore, so the method name is semantically misleading.
+ // We should remove this method in next major release and just move this call to the ctor.
+ return Constraint.isNotNull(ConfigurationService.get(DecryptionParserPool.class),
+ "DecryptionParserPool has not been registered with the global configuration").getParserPool();
}
/**
diff --git a/opensaml-xmlsec-api/src/main/resources/META-INF/services/org.opensaml.core.config.Initializer b/opensaml-xmlsec-api/src/main/resources/META-INF/services/org.opensaml.core.config.Initializer
index 1b8b103..07932f4 100644
--- a/opensaml-xmlsec-api/src/main/resources/META-INF/services/org.opensaml.core.config.Initializer
+++ b/opensaml-xmlsec-api/src/main/resources/META-INF/services/org.opensaml.core.config.Initializer
@@ -1 +1,2 @@
-org.opensaml.xmlsec.config.GlobalAlgorithmRegistryInitializer
\ No newline at end of file
+org.opensaml.xmlsec.config.GlobalAlgorithmRegistryInitializer
+org.opensaml.xmlsec.config.DecryptionParserPoolInitializer
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list