[xmlsectool] branch main updated: XSTJ-85 - Deprecate "blacklist" terminology in CLI
Ian Young
ian at iay.org.uk
Fri Nov 13 17:56:14 UTC 2020
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch main
in repository xmlsectool.
View the commit online:
http://git.shibboleth.net/view/?p=xmlsectool.git;a=commit;h=6a47cda6cd00152481b8c2f2162c6e56ba125a74
The following commit(s) were added to refs/heads/main by this push:
new 6a47cda XSTJ-85 - Deprecate "blacklist" terminology in CLI
6a47cda is described below
commit 6a47cda6cd00152481b8c2f2162c6e56ba125a74
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Fri Nov 13 17:56:08 2020 +0000
XSTJ-85 - Deprecate "blacklist" terminology in CLI
https://issues.shibboleth.net/jira/browse/XSTJ-85
---
.../net/shibboleth/tool/xmlsectool/Blacklist.java | 192 ---------------------
.../tool/xmlsectool/CommandLineArguments.java | 139 +++++++++++----
.../tool/xmlsectool/DisallowedAlgorithms.java | 136 +++++++++++++++
.../net/shibboleth/tool/xmlsectool/XMLSecTool.java | 20 +--
.../tool/xmlsectool/CommandLineArgumentsTest.java | 10 +-
.../net/shibboleth/tool/xmlsectool/XSTJ59Test.java | 2 +-
6 files changed, 260 insertions(+), 239 deletions(-)
diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/Blacklist.java b/src/main/java/net/shibboleth/tool/xmlsectool/Blacklist.java
deleted file mode 100644
index 8d3e726..0000000
--- a/src/main/java/net/shibboleth/tool/xmlsectool/Blacklist.java
+++ /dev/null
@@ -1,192 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.tool.xmlsectool;
-
-import java.io.PrintStream;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.Set;
-import java.util.TreeSet;
-
-import org.opensaml.xmlsec.signature.support.SignatureConstants;
-
-/**
- * A blacklist of digest and signature algorithms we should not accept during
- * signature verification.
- */
-public class Blacklist {
-
- /**
- * Ordered set of blacklisted digest algorithm URIs.
- */
- private final Set<String> digestBlacklist = new TreeSet<>();
-
- /**
- * Ordered set of blacklisted signature algorithm URIs.
- */
- private final Set<String> signatureBlacklist = new TreeSet<>();
-
- /**
- * Constructor.
- *
- * Initializes the blacklist with those algorithms that should be
- * blacklisted by default.
- */
- public Blacklist() {
- // MD5
- addDigestAlgorithm(SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5);
- addSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5);
-
- // SHA-1
- addDigest(DigestChoice.SHA1);
- }
-
- /**
- * Blacklist an individual digest algorithm.
- *
- * @param uri algorithm URI to blacklist
- */
- private void addDigestAlgorithm(final String uri) {
- digestBlacklist.add(uri);
- }
-
- /**
- * Whitelist an individual digest algorithm.
- *
- * @param uri algorithm URI to whitelist
- */
- private void removeDigestAlgorithm(final String uri) {
- digestBlacklist.remove(uri);
- }
-
- /**
- * Blacklist an individual signature algorithm.
- *
- * @param uri algorithm URI to blacklist
- */
- private void addSignatureAlgorithm(final String uri) {
- signatureBlacklist.add(uri);
- }
-
- /**
- * Whitelist an individual signature algorithm.
- *
- * @param uri algorithm URI to whitelist
- */
- private void removeSignatureAlgorithm(final String uri) {
- signatureBlacklist.remove(uri);
- }
-
- /**
- * Blacklist the digest and signature algorithms associated with
- * a {@link DigestChoice}.
- *
- * @param digestChoice {@link DigestChoice} to add to blacklist
- */
- public void addDigest(final DigestChoice digestChoice) {
- addDigestAlgorithm(digestChoice.getDigestAlgorithm());
- addSignatureAlgorithm(digestChoice.getRSAAlgorithm());
- addSignatureAlgorithm(digestChoice.getECDSAAlgorithm());
- }
-
- /**
- * Whitelist the digest and signature algorithms associated with
- * a {@link DigestChoice}.
- *
- * @param digestChoice {@link DigestChoice} to remove from blacklist
- */
- public void removeDigest(final DigestChoice digestChoice) {
- removeDigestAlgorithm(digestChoice.getDigestAlgorithm());
- removeSignatureAlgorithm(digestChoice.getRSAAlgorithm());
- removeSignatureAlgorithm(digestChoice.getECDSAAlgorithm());
- }
-
- /**
- * Returns <code>true</code> if the indicated algorithm URI is blacklisted for
- * use as a digest algorithm.
- *
- * @param alg digest algorithm URI to check
- * @return <code>true</code> if the algorithm is blacklisted
- */
- public boolean isBlacklistedDigest(final String alg) {
- return digestBlacklist.contains(alg);
- }
-
- /**
- * Returns <code>true</code> if the indicated algorithm URI is blacklisted for
- * use as a signature algorithm.
- *
- * @param alg signature algorithm URI to check
- * @return <code>true</code> if the algorithm is blacklisted
- */
- public boolean isBlacklistedSignature(final String alg) {
- return signatureBlacklist.contains(alg);
- }
-
- /**
- * Returns an unmodifiable view on the set of blacklisted digest algorithms.
- *
- * @return set of blacklisted algorithms
- */
- public Collection<String> getDigestBlacklist() {
- return Collections.unmodifiableCollection(digestBlacklist);
- }
-
- /**
- * Returns an unmodifiable view on the set of blacklisted signature algorithms.
- *
- * @return set of blacklisted algorithms
- */
- public Collection<String> getSignatureBlacklist() {
- return Collections.unmodifiableCollection(signatureBlacklist);
- }
-
- /**
- * Empties the digest and signature blacklists.
- */
- public void clear() {
- digestBlacklist.clear();
- signatureBlacklist.clear();
- }
-
- /**
- * List out the contents of the blacklist.
- *
- * @param out stream to send the listing to
- */
- public void list(final PrintStream out) {
- out.println("Digest algorithm blacklist:");
- if (getDigestBlacklist().isEmpty()) {
- out.println(" blacklist is empty");
- } else {
- for (final String uri: getDigestBlacklist()) {
- out.println(" " + uri);
- }
- }
- out.println();
- out.println("Signature algorithm blacklist:");
- if (getSignatureBlacklist().isEmpty()) {
- out.println(" blacklist is empty");
- } else {
- for (final String uri: getSignatureBlacklist()) {
- out.println(" " + uri);
- }
- }
- out.println();
- }
-}
diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/CommandLineArguments.java b/src/main/java/net/shibboleth/tool/xmlsectool/CommandLineArguments.java
index 6b3fb3c..a8f0d81 100644
--- a/src/main/java/net/shibboleth/tool/xmlsectool/CommandLineArguments.java
+++ b/src/main/java/net/shibboleth/tool/xmlsectool/CommandLineArguments.java
@@ -68,10 +68,18 @@ public class CommandLineArguments {
private static final String KEYSTORE_TYPE_ARG = "keystoreType";
private static final String KEYSTORE_PROVIDER_ARG = "keystoreProvider";
private static final String PKCS11_CONFIG_ARG = "pkcs11Config";
+ @Deprecated(since="3.0.0", forRemoval=true)
private static final String CLEAR_BLACKLIST_ARG = "clearBlacklist";
+ private static final String ALLOW_ALL_DIGESTS_ARG = "allowAllDigests";
+ @Deprecated(since="3.0.0", forRemoval=true)
private static final String BLACKLIST_DIGEST_ARG = "blacklistDigest";
+ private static final String DISALLOW_DIGEST_ARG = "disallowDigest";
+ @Deprecated(since="3.0.0", forRemoval=true)
private static final String WHITELIST_DIGEST_ARG = "whitelistDigest";
+ private static final String ALLOW_DIGEST_ARG = "allowDigest";
+ @Deprecated(since="3.0.0", forRemoval=true)
private static final String LIST_BLACKLIST_ARG = "listBlacklist";
+ private static final String LIST_ALGORITHMS_ARG = "listAlgorithms";
private static final String OUT_FILE_ARG = "outFile";
private static final String DEFLATE_OUT_ARG = "deflateOutput";
private static final String GZIP_OUT_ARG = "gzipOutput";
@@ -201,31 +209,50 @@ public class CommandLineArguments {
@Parameter(names = OPT + PKCS11_CONFIG_ARG)
private String pkcs11Config;
- // Blacklisting
+ // Allowed / Disallowed algorithms.
/**
- * Local blacklist of signature and digest algorithms.
+ * Local collection of disallowed signature and digest algorithms.
*/
- private final Blacklist blacklist = new Blacklist();
+ private final DisallowedAlgorithms disallowedAlgorithms = new DisallowedAlgorithms();
/**
- * Option requesting that the signature verification
- * blacklists be cleared.
+ * Option requesting that all digest algorithms should be allowed.
*/
+ @Parameter(names = OPT + ALLOW_ALL_DIGESTS_ARG)
+ private boolean allowAllDigests;
@Parameter(names = OPT + CLEAR_BLACKLIST_ARG)
+ @Deprecated(since="3.0.0", forRemoval=true)
private boolean clearBlacklist;
/**
* Option requesting that the signature verification
- * blacklists be listed.
+ * algorithms be listed.
*/
+ @Parameter(names = OPT + LIST_ALGORITHMS_ARG)
+ private boolean listAlgorithms;
@Parameter(names = OPT + LIST_BLACKLIST_ARG)
+ @Deprecated(since="3.0.0", forRemoval=true)
private boolean listBlacklist;
+ /**
+ * Option requesting that algorithms associated with a specific digest
+ * be disallowed.
+ */
+ @Parameter(names = OPT + DISALLOW_DIGEST_ARG)
+ private List<String> disallowDigestNames;
@Parameter(names = OPT + BLACKLIST_DIGEST_ARG)
+ @Deprecated(since="3.0.0", forRemoval=true)
private List<String> blacklistDigestNames;
+ /**
+ * Option requesting that algorithms associated with a specific digest
+ * be allowed.
+ */
+ @Parameter(names = OPT + ALLOW_DIGEST_ARG)
+ private List<String> allowDigestNames;
@Parameter(names = OPT + WHITELIST_DIGEST_ARG)
+ @Deprecated(since="3.0.0", forRemoval=true)
private List<String> whitelistDigestNames;
// Logging
@@ -267,7 +294,7 @@ public class CommandLineArguments {
}
validateCommandLineArguments();
- processBlacklistOptions();
+ processDisallowedAlgorithmOptions();
} catch (final ParameterException e) {
errorAndExit(e.getMessage());
}
@@ -291,16 +318,64 @@ public class CommandLineArguments {
}
}
+ // --clearBlacklist changed to --allowAllDigests in V3.0.0
+ if (clearBlacklist) {
+ DeprecationSupport.warn(ObjectType.CLI_OPTION, OPT + CLEAR_BLACKLIST_ARG,
+ null, OPT + ALLOW_ALL_DIGESTS_ARG);
+ }
+
+ // --listBlacklist changed to --listAlgorithms in V3.0.0
+ if (listBlacklist) {
+ DeprecationSupport.warn(ObjectType.CLI_OPTION, OPT + LIST_BLACKLIST_ARG,
+ null, OPT + LIST_ALGORITHMS_ARG);
+ }
+
+ // --blacklistDigest changed to --disallowDigest in V3.0.0
+ if (blacklistDigestNames != null) {
+ DeprecationSupport.warn(ObjectType.CLI_OPTION, OPT + BLACKLIST_DIGEST_ARG,
+ null, OPT + DISALLOW_DIGEST_ARG);
+ }
+
+ // --whitelistDigest changed to --allowDigest in V3.0.0
+ if (whitelistDigestNames != null) {
+ DeprecationSupport.warn(ObjectType.CLI_OPTION, OPT + WHITELIST_DIGEST_ARG,
+ null, OPT + ALLOW_DIGEST_ARG);
+ }
}
/**
- * Handle options related to setting up the blacklist.
+ * Handle options related to setting up the disallowed algorithm collection.
*
- * These are --clearBlacklist, --blacklistDigest and --whitelistDigest.
+ * These are <code>--allowAllDigests</code>, <code>--disallowDigest</code>
+ * and <code>--allowDigest</code>.
+ *
+ * The legacy forms (<code>--clearBlacklist</code>, <code>--blacklistDigest</code>
+ * and <code>--whitelistDigest</code> are also handled here.
*/
- private void processBlacklistOptions() {
- if (clearBlacklist) {
- blacklist.clear();
+ // Checkstyle: CyclomaticComplexity OFF
+ private void processDisallowedAlgorithmOptions() {
+ if (allowAllDigests || clearBlacklist) {
+ disallowedAlgorithms.allowAllDigests();
+ }
+
+ if (disallowDigestNames != null) {
+ for (final String name : disallowDigestNames) {
+ final DigestChoice dig = DigestChoice.find(name);
+ if (dig == null) {
+ errorAndExit("digest choice \"" + name + "\" was not recognised");
+ }
+ disallowedAlgorithms.disallowDigest(dig);
+ }
+ }
+
+ if (allowDigestNames != null) {
+ for (final String name : allowDigestNames) {
+ final DigestChoice dig = DigestChoice.find(name);
+ if (dig == null) {
+ errorAndExit("digest choice \"" + name + "\" was not recognised");
+ }
+ disallowedAlgorithms.allowDigest(dig);
+ }
}
if (blacklistDigestNames != null) {
@@ -309,7 +384,7 @@ public class CommandLineArguments {
if (dig == null) {
errorAndExit("digest choice \"" + name + "\" was not recognised");
}
- blacklist.addDigest(dig);
+ disallowedAlgorithms.disallowDigest(dig);
}
}
@@ -319,10 +394,12 @@ public class CommandLineArguments {
if (dig == null) {
errorAndExit("digest choice \"" + name + "\" was not recognised");
}
- blacklist.removeDigest(dig);
+ disallowedAlgorithms.allowDigest(dig);
}
}
}
+ // Checkstyle: CyclomaticComplexity OFF
+
// Checkstyle: JavadocMethod OFF
@@ -479,21 +556,21 @@ public class CommandLineArguments {
}
/**
- * Returns the signature verification algorithm blacklist.
+ * Returns the {link @DisallowedAlgorithms}.
*
- * @return algorithm blacklist
+ * @return a {@link DisallowedAlgorithms} instance
*/
- public Blacklist getBlacklist() {
- return blacklist;
+ public DisallowedAlgorithms getDisallowedAlgorithms() {
+ return disallowedAlgorithms;
}
/**
- * Indicates whether the option to list the blacklist has been selected.
+ * Indicates whether the option to list the disallowed algorithms has been selected.
*
* @return <code>true</code> if option selected
*/
- public boolean doListBlacklist() {
- return listBlacklist;
+ public boolean doListAlgorithms() {
+ return listAlgorithms || listBlacklist;
}
public boolean doVerboseOutput() {
@@ -520,7 +597,7 @@ public class CommandLineArguments {
return;
}
- if (doListBlacklist()) {
+ if (listAlgorithms || listBlacklist) {
return;
}
@@ -730,15 +807,15 @@ public class CommandLineArguments {
out.println(String.format(" --%-20s %s", KEY_PASSWORD_ARG, "Specifies the pin for the signing key."));
out.println();
- out.println("Signature verification algorithm blacklist options:");
- out.println(String.format(" --%-20s %s", CLEAR_BLACKLIST_ARG,
- "Clear the algorithm blacklist."));
- out.println(String.format(" --%-20s %s", BLACKLIST_DIGEST_ARG,
- "Blacklist a digest by name (e.g., \"SHA-1\"). Can be used any number of times."));
- out.println(String.format(" --%-20s %s", WHITELIST_DIGEST_ARG,
- "Whitelist a digest by name (e.g., \"SHA-1\"). Can be used any number of times."));
- out.println(String.format(" --%-20s %s", LIST_BLACKLIST_ARG,
- "List the contents of the algorithm blacklist."));
+ out.println("Signature verification algorithm options:");
+ out.println(String.format(" --%-20s %s", ALLOW_ALL_DIGESTS_ARG,
+ "Allow all digests in signatures to be verified."));
+ out.println(String.format(" --%-20s %s", DISALLOW_DIGEST_ARG,
+ "Disallow a digest by name (e.g., \"SHA-1\"). Can be used any number of times."));
+ out.println(String.format(" --%-20s %s", ALLOW_DIGEST_ARG,
+ "Allow a digest by name (e.g., \"SHA-1\"). Can be used any number of times."));
+ out.println(String.format(" --%-20s %s", LIST_ALGORITHMS_ARG,
+ "List the algorithms disallowed for signature verification."));
out.println();
out.println("Data Output Options - Option '" + OUT_FILE_ARG + "' is required.");
diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/DisallowedAlgorithms.java b/src/main/java/net/shibboleth/tool/xmlsectool/DisallowedAlgorithms.java
new file mode 100644
index 0000000..d505e6a
--- /dev/null
+++ b/src/main/java/net/shibboleth/tool/xmlsectool/DisallowedAlgorithms.java
@@ -0,0 +1,136 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.tool.xmlsectool;
+
+import java.io.PrintStream;
+import java.util.Set;
+import java.util.TreeSet;
+
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+
+/**
+ * A collection of insecure or otherwise undesirable digest algorithms and signature algorithms,
+ * to be used to prevent their use in the validation of digital signatures.
+ */
+public class DisallowedAlgorithms {
+
+ /**
+ * Ordered set of disallowed digest algorithm URIs.
+ */
+ private final Set<String> digestAlgorithms = new TreeSet<>();
+
+ /**
+ * Ordered set of disallowed signature algorithm URIs.
+ */
+ private final Set<String> signatureAlgorithms = new TreeSet<>();
+
+ /**
+ * Constructor.
+ *
+ * Initializes the collections with those algorithms that should be
+ * regarded as unusable by default.
+ */
+ public DisallowedAlgorithms() {
+ // MD5
+ digestAlgorithms.add(SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5);
+ signatureAlgorithms.add(SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5);
+
+ // SHA-1
+ disallowDigest(DigestChoice.SHA1);
+ }
+
+ /**
+ * Add the digest and signature algorithms associated with
+ * a {@link DigestChoice}.
+ *
+ * @param digestChoice {@link DigestChoice} to add
+ */
+ public void disallowDigest(final DigestChoice digestChoice) {
+ digestAlgorithms.add(digestChoice.getDigestAlgorithm());
+ signatureAlgorithms.add(digestChoice.getRSAAlgorithm());
+ signatureAlgorithms.add(digestChoice.getECDSAAlgorithm());
+ }
+
+ /**
+ * Remove the digest and signature algorithms associated with
+ * a {@link DigestChoice}.
+ *
+ * @param digestChoice {@link DigestChoice} to remove
+ */
+ public void allowDigest(final DigestChoice digestChoice) {
+ digestAlgorithms.remove(digestChoice.getDigestAlgorithm());
+ signatureAlgorithms.remove(digestChoice.getRSAAlgorithm());
+ signatureAlgorithms.remove(digestChoice.getECDSAAlgorithm());
+ }
+
+ /**
+ * Returns <code>true</code> if the indicated algorithm URI is disallowed for
+ * use as a digest algorithm.
+ *
+ * @param alg digest algorithm URI to check
+ * @return <code>true</code> if the algorithm is disallowed
+ */
+ public boolean isDigestAlgorithmDisallowed(final String alg) {
+ return digestAlgorithms.contains(alg);
+ }
+
+ /**
+ * Returns <code>true</code> if the indicated algorithm URI is disallowed for
+ * use as a signature algorithm.
+ *
+ * @param alg signature algorithm URI to check
+ * @return <code>true</code> if the algorithm is disallowed
+ */
+ public boolean isSignatureAlgorithmDisallowed(final String alg) {
+ return signatureAlgorithms.contains(alg);
+ }
+
+ /**
+ * Empties the disallowed digest and signature algorithm lists.
+ */
+ public void allowAllDigests() {
+ digestAlgorithms.clear();
+ signatureAlgorithms.clear();
+ }
+
+ /**
+ * List out the contents of the algorithm collections.
+ *
+ * @param out stream to send the listing to
+ */
+ public void list(final PrintStream out) {
+ out.println("Disallowed digest algorithms:");
+ if (digestAlgorithms.isEmpty()) {
+ out.println(" (none)");
+ } else {
+ for (final String uri: digestAlgorithms) {
+ out.println(" " + uri);
+ }
+ }
+ out.println();
+ out.println("Disallowed signature algorithms:");
+ if (signatureAlgorithms.isEmpty()) {
+ out.println(" (none)");
+ } else {
+ for (final String uri : signatureAlgorithms) {
+ out.println(" " + uri);
+ }
+ }
+ out.println();
+ }
+}
diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/XMLSecTool.java b/src/main/java/net/shibboleth/tool/xmlsectool/XMLSecTool.java
index 0b13e82..09e36b8 100644
--- a/src/main/java/net/shibboleth/tool/xmlsectool/XMLSecTool.java
+++ b/src/main/java/net/shibboleth/tool/xmlsectool/XMLSecTool.java
@@ -134,8 +134,8 @@ public final class XMLSecTool {
return;
}
- if (cli.doListBlacklist()) {
- cli.getBlacklist().list(System.out);
+ if (cli.doListAlgorithms()) {
+ cli.getDisallowedAlgorithms().list(System.out);
return;
}
@@ -675,12 +675,12 @@ public final class XMLSecTool {
final Reference ref = extractReference(signature);
markIdAttribute(xmlDocument.getDocumentElement(), ref);
- // check reference digest algorithm against blacklist
+ // check reference digest algorithm is allowed
try {
final String alg = ref.getMessageDigestAlgorithm().getAlgorithmURI();
- log.debug("blacklist checking digest {}", alg);
- if (cli.getBlacklist().isBlacklistedDigest(alg)) {
- log.error("Digest algorithm {} is blacklisted", alg);
+ log.debug("checking digest {} allowed", alg);
+ if (cli.getDisallowedAlgorithms().isDigestAlgorithmDisallowed(alg)) {
+ log.error("Digest algorithm {} is disallowed", alg);
throw new Terminator(ReturnCode.RC_SIG);
}
} catch (final XMLSignatureException e) {
@@ -688,11 +688,11 @@ public final class XMLSecTool {
throw new Terminator(ReturnCode.RC_SIG);
}
- // check signature algorithm against blacklist
+ // check signature algorithm is allowed
final String alg = signature.getSignedInfo().getSignatureMethodURI();
- log.debug("blacklist checking signature method {}", alg);
- if (cli.getBlacklist().isBlacklistedSignature(alg)) {
- log.error("Signature algorithm {} is blacklisted", alg);
+ log.debug("checking signature method {} is allowed", alg);
+ if (cli.getDisallowedAlgorithms().isSignatureAlgorithmDisallowed(alg)) {
+ log.error("Signature algorithm {} is disallowed", alg);
throw new Terminator(ReturnCode.RC_SIG);
}
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/CommandLineArgumentsTest.java b/src/test/java/net/shibboleth/tool/xmlsectool/CommandLineArgumentsTest.java
index a605e2f..4c48149 100644
--- a/src/test/java/net/shibboleth/tool/xmlsectool/CommandLineArgumentsTest.java
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/CommandLineArgumentsTest.java
@@ -40,7 +40,7 @@ public class CommandLineArgumentsTest {
}
@Test
- public void xstj39_default_blacklist_SHA1() throws Exception {
+ public void xstj39_default_disallowed_SHA1() throws Exception {
final String[] args = {
"--sign",
"--inFile", "in.xml",
@@ -50,9 +50,9 @@ public class CommandLineArgumentsTest {
};
final CommandLineArguments cli = new CommandLineArguments();
cli.parseCommandLineArguments(args);
- final Blacklist blacklist = cli.getBlacklist();
- Assert.assertTrue(blacklist.isBlacklistedDigest(SignatureConstants.ALGO_ID_DIGEST_SHA1));
- Assert.assertTrue(blacklist.isBlacklistedSignature(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
- Assert.assertTrue(blacklist.isBlacklistedSignature(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA1));
+ final DisallowedAlgorithms disallowed = cli.getDisallowedAlgorithms();
+ Assert.assertTrue(disallowed.isDigestAlgorithmDisallowed(SignatureConstants.ALGO_ID_DIGEST_SHA1));
+ Assert.assertTrue(disallowed.isSignatureAlgorithmDisallowed(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
+ Assert.assertTrue(disallowed.isSignatureAlgorithmDisallowed(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA1));
}
}
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ59Test.java b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ59Test.java
index 51b6e92..0a66deb 100644
--- a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ59Test.java
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ59Test.java
@@ -51,7 +51,7 @@ public class XSTJ59Test extends BaseTest {
"--certificate", "sign.crt",
"--key", "sign.key",
"--digest", "SHA-1",
- "--whitelistDigest", "SHA-1"
+ "--allowDigest", "SHA-1"
};
final CommandLineArguments cli = new CommandLineArguments();
cli.parseCommandLineArguments(args);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list