[cpp-xmltooling] branch main updated: CPPXT-155 - Block CipherReference in Decrypter class
Scott Cantor
cantor.2 at osu.edu
Mon Jan 9 20:57:32 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-xmltooling.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=836c962f5c2ddfd3c18c06ced29a3f8e1dc818b0
The following commit(s) were added to refs/heads/main by this push:
new 836c962 CPPXT-155 - Block CipherReference in Decrypter class
836c962 is described below
commit 836c962f5c2ddfd3c18c06ced29a3f8e1dc818b0
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jan 9 15:57:04 2023 -0500
CPPXT-155 - Block CipherReference in Decrypter class
https://shibboleth.atlassian.net/browse/CPPXT-155
Added a unit test for the fix.
---
xmltooling/encryption/impl/Decrypter.cpp | 24 +++++++++
xmltoolingtest/EncryptionTest.h | 5 ++
xmltoolingtest/data/BadKeyInfo/CipherReference.xml | 57 ++++++++++++++++++++++
3 files changed, 86 insertions(+)
diff --git a/xmltooling/encryption/impl/Decrypter.cpp b/xmltooling/encryption/impl/Decrypter.cpp
index 99514a4..ccbd9f2 100644
--- a/xmltooling/encryption/impl/Decrypter.cpp
+++ b/xmltooling/encryption/impl/Decrypter.cpp
@@ -51,6 +51,19 @@ using namespace xercesc;
using boost::scoped_ptr;
using namespace std;
+// Using static method for now to avoid ABI impact.
+
+namespace {
+
+ static void blockCipherReference(const EncryptedType& encryptedType) {
+ const CipherData* cipherData = encryptedType.getCipherData();
+ if (cipherData && cipherData->getCipherReference()) {
+ throw DecryptionException("CipherReference not supported");
+ }
+ }
+
+}
+
Decrypter::Decrypter(
const CredentialResolver* credResolver,
@@ -84,6 +97,8 @@ DOMDocumentFragment* Decrypter::decryptData(const EncryptedData& encryptedData,
if (encryptedData.getDOM() == nullptr)
throw DecryptionException("The object must be marshalled before decryption.");
+ blockCipherReference(encryptedData);
+
XMLToolingInternalConfig& xmlconf = XMLToolingInternalConfig::getInternalConfig();
if (m_requireAuthenticatedCipher) {
const XMLCh* alg = encryptedData.getEncryptionMethod() ? encryptedData.getEncryptionMethod()->getAlgorithm() : nullptr;
@@ -125,6 +140,8 @@ DOMDocumentFragment* Decrypter::decryptData(const EncryptedData& encryptedData,
if (!m_credResolver)
throw DecryptionException("No CredentialResolver supplied to provide decryption keys.");
+ blockCipherReference(encryptedData);
+
// Resolve a decryption key directly.
vector<const Credential*> creds;
int types = CredentialCriteria::KEYINFO_EXTRACTION_KEY | CredentialCriteria::KEYINFO_EXTRACTION_KEYNAMES;
@@ -195,6 +212,8 @@ void Decrypter::decryptData(ostream& out, const EncryptedData& encryptedData, co
if (encryptedData.getDOM() == nullptr)
throw DecryptionException("The object must be marshalled before decryption.");
+ blockCipherReference(encryptedData);
+
XMLToolingInternalConfig& xmlconf = XMLToolingInternalConfig::getInternalConfig();
if (m_requireAuthenticatedCipher) {
const XMLCh* alg = encryptedData.getEncryptionMethod() ? encryptedData.getEncryptionMethod()->getAlgorithm() : nullptr;
@@ -236,6 +255,8 @@ void Decrypter::decryptData(ostream& out, const EncryptedData& encryptedData, co
if (!m_credResolver)
throw DecryptionException("No CredentialResolver supplied to provide decryption keys.");
+ blockCipherReference(encryptedData);
+
// Resolve a decryption key directly.
vector<const Credential*> creds;
int types = CredentialCriteria::KEYINFO_EXTRACTION_KEY | CredentialCriteria::KEYINFO_EXTRACTION_KEYNAMES;
@@ -303,6 +324,8 @@ XSECCryptoKey* Decrypter::decryptKey(const EncryptedKey& encryptedKey, const XML
if (encryptedKey.getDOM()==nullptr)
throw DecryptionException("The object must be marshalled before decryption.");
+ blockCipherReference(encryptedKey);
+
const XSECAlgorithmHandler* handler;
try {
handler = XSECPlatformUtils::g_algorithmMapper->mapURIToHandler(algorithm);
@@ -406,3 +429,4 @@ XSECCryptoKey* Decrypter::decryptKey(const EncryptedKey& encryptedKey, const XML
throw DecryptionException(string("XMLSecurity exception while generating key: ") + e.getMsg());
}
}
+
diff --git a/xmltoolingtest/EncryptionTest.h b/xmltoolingtest/EncryptionTest.h
index 7280125..5696296 100644
--- a/xmltoolingtest/EncryptionTest.h
+++ b/xmltoolingtest/EncryptionTest.h
@@ -166,4 +166,9 @@ public:
preEncrypted("BadKeyInfo/retrievalEmpty.xml", true);
}
+ void testCipherReference()
+ {
+ preEncrypted("BadKeyInfo/cipherReference.xml", true);
+ }
+
};
diff --git a/xmltoolingtest/data/BadKeyInfo/CipherReference.xml b/xmltoolingtest/data/BadKeyInfo/CipherReference.xml
new file mode 100644
index 0000000..8e9927d
--- /dev/null
+++ b/xmltoolingtest/data/BadKeyInfo/CipherReference.xml
@@ -0,0 +1,57 @@
+<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Element">
+ <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+
+ <xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
+ <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
+ <ds:KeyInfo>
+ <ds:KeyName>Sample Key</ds:KeyName>
+ <ds:KeyName>sp.example.org</ds:KeyName>
+ <ds:X509Data>
+ <ds:X509SubjectName>CN=sp.example.org,O=Internet2,C=US</ds:X509SubjectName>
+ <ds:X509Certificate>MIICjzCCAfigAwIBAgIJAKk8t1hYcMkhMA0GCSqGSIb3DQEBBAUAMDoxCzAJBgNV
+ BAYTAlVTMRIwEAYDVQQKEwlJbnRlcm5ldDIxFzAVBgNVBAMTDnNwLmV4YW1wbGUu
+ b3JnMB4XDTA1MDYyMDE1NDgzNFoXDTMyMTEwNTE1NDgzNFowOjELMAkGA1UEBhMC
+ VVMxEjAQBgNVBAoTCUludGVybmV0MjEXMBUGA1UEAxMOc3AuZXhhbXBsZS5vcmcw
+ gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANlZ1L1mKzYbUVKiMQLhZlfGDyYa
+ /jjCiaXP0WhLNgvJpOTeajvsrApYNnFX5MLNzuC3NeQIjXUNLN2Yo2MCSthBIOL5
+ qE5dka4z9W9zytoflW1LmJ8vXpx8Ay/meG4z//J5iCpYVEquA0xl28HUIlownZUF
+ 7w7bx0cF/02qrR23AgMBAAGjgZwwgZkwHQYDVR0OBBYEFJZiO1qsyAyc3HwMlL9p
+ JpN6fbGwMGoGA1UdIwRjMGGAFJZiO1qsyAyc3HwMlL9pJpN6fbGwoT6kPDA6MQsw
+ CQYDVQQGEwJVUzESMBAGA1UEChMJSW50ZXJuZXQyMRcwFQYDVQQDEw5zcC5leGFt
+ cGxlLm9yZ4IJAKk8t1hYcMkhMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQAD
+ gYEAMFq/UeSQyngE0GpZueyD2UW0M358uhseYOgGEIfm+qXIFQF6MYwNoX7WFzhC
+ LJZ2E6mEvZZFHCHUtl7mGDvsRwgZ85YCtRbvleEpqfgNQToto9pLYe+X6vvH9Z6p
+ gmYsTmak+kxO93JprrOd9xp8aZPMEprL7VCdrhbZEfyYER0=
+ </ds:X509Certificate>
+ </ds:X509Data>
+ </ds:KeyInfo>
+ <xenc:CipherData>
+ <xenc:CipherReference URI="http://localhost/cipherReference.xml" />
+ </xenc:CipherData>
+ </xenc:EncryptedKey>
+ </ds:KeyInfo>
+ <xenc:CipherData>
+ <xenc:CipherValue>i2n4xM6LBUuzlmnXPtNUYC/V1FMhC7DJomOmU4x+PcV6ybBT7/0Xy5rlpnXPweWgmmSJB7QezHr1
+ VDCurTngAaPwO6X2sn+ixJ3K4+OM8Y33Sd/NVgNtqX7sJsoY+Ii9mWFXZ7KjufQbQFRijdexC80l
+ R4AOCNOi/3iSzNFvw6/mw3azPi42Z5yGyZ5swm5IjToagWJoWcbeICC/fWCcxJUfmjjXuhkJcckg
+ uq8xgYvJqE6HcOy2N1KY70JhKkyasgXC2mt0UDSjT0i9af+EvpU3sksz/FpUtMDD9SXCIpZEjdpE
+ LPLtqkvbL3kXvCplI4r1AJIb4lyfvT24gyuUHyyP9DwdDXH8E71yjA4Uf86FPLDodKkdpt4faIbR
+ lo43rQvlpAlN2bfwlbW2k2WHDAueqA2LJ6Ksvuh/Qx6qnj9xMrF6Cs7kjiSitLJNPH/ZSMqqSGhs
+ 3yL4c97d99B3SGbJdIkrR8Fxiz8BCuNGz8XTKn2/jnQBCQTeRm57wAcYLrsdU2KXXNfa1mDMFqSr
+ elnEv25FNVy8qi+BWatBiXXBSAp36vg0ClLPB2ri2TWSRQVrsFMYkvy7+PpUTKpF1G9/gxOxoWuC
+ kaoRYEdebFkNZHRhP0osGqUJtmivH6VyPBGGz8qRbnXVkzFuYw722EebC9HXltQ5S570Gsj+ipSs
+ k46kWTr2xb2tAp3XU3hWwy3BpIfSLQCzWHqYSJwVbJ8DmaY3YInUM7VJ6224aARgRQRzA9el1hlb
+ OeXfvVoPWFYtzs4AOGgY7YVQ3KzLN803aOlRIT6qF9W9BVcU19RdtQSXgpmPX5X4oFdo7UEH+cRX
+ ATfQhFmSx90PsvxrklJWtEbTdC6Y3Se82ezUGPzT1/a3iCd92w87VrwdCYP+FNIBTLTiN+PNHd9W
+ jBGV2xM/VqHF/Ss36dopdjZAkJh1P3JNVOG1POqZmB7M7W+7O6eymOJXvE3mrbsZOUnw9GDmz+Ie
+ 8IQQ2R+WCZ+bXN4BmEwevTb0qvC2KvQglfUZvc4bRCtzQGhSdhiiOAD7PgYtlvgP2qbWGpfpKO7b
+ j0qyMT5+4tgR9F1CuUA2NXH93btsnMI4ycmX481pxW9Aad67DEhm+NoF8nHIwk2LZhdTKprj4IyG
+ Q/jEiwSALFmcKQFpszhWpIphJgMkGIkNl6ofk3mtADvCRkMMxTL57PHxGvhv1urfr7fm4He0+XSY
+ YzCA++uMOCsT3vvm5PoyvTtkWwCeQ3CjwxLrEStkXjt/gWokhoNWARCaLXqV3IDJAaeJluIt0Wqv
+ QnQROwb6u23h0k2DtaRMa6Xi+KvnmqaGvvFH9mpdcMFh/U857GJYYTiIMq/CXL7TUm3+tVByGWfl
+ LVJekbXAe177iIJbR9+2NcLU0cBDVMkC+PNnLcXiVV3q7BrNMVJFzZ6WUkH/+8Ih2T8Lrlu3APSc
+ qmqyiFq/DLTSzlPLGfHZYwMg7JYtY0jWXXsxKlOEz7OBKUbQPg==
+ </xenc:CipherValue>
+ </xenc:CipherData>
+</xenc:EncryptedData>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list