[java-metadata-aggregator] branch main updated: MDA-245 - Terminology changes
Ian Young
ian at iay.org.uk
Wed May 1 14:59:06 UTC 2024
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch main
in repository java-metadata-aggregator.
View the commit online:
http://git.shibboleth.net/view/?p=java-metadata-aggregator.git;a=commit;h=dc1677c700b266ac7983cd211c99667f4c017172
The following commit(s) were added to refs/heads/main by this push:
new dc1677c MDA-245 - Terminology changes
dc1677c is described below
commit dc1677c700b266ac7983cd211c99667f4c017172
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Wed May 1 15:59:00 2024 +0100
MDA-245 - Terminology changes
https://shibboleth.atlassian.net/browse/MDA-245
---
.../metadata/dom/impl/XMLSignatureValidator.java | 44 +++++++++++-----------
...trationAuthorityItemIdentificationStrategy.java | 2 +-
.../dom/XMLSignatureValidationStageTest.java | 8 ++--
.../keylists/rsa/legacy/compromised-1024.txt | 4 +-
.../metadata/keylists/rsa/legacy/debian-1024.txt | 2 +-
.../metadata/keylists/rsa/legacy/debian-512.txt | 2 +-
6 files changed, 31 insertions(+), 31 deletions(-)
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureValidator.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureValidator.java
index c4de3d1..6c3b2e3 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureValidator.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureValidator.java
@@ -68,11 +68,11 @@ public final class XMLSignatureValidator {
/** Public key used to verify signatures. */
private final PublicKey verificationKey;
- /** Set of blacklisted digest algorithms. */
- private final Set<String> blacklistedDigests;
+ /** Set of disallowed digest algorithms. */
+ private final Set<String> disallowedDigests;
- /** Set of blacklisted signature methods. */
- private final Set<String> blacklistedSignatureMethods;
+ /** Set of disallowed signature methods. */
+ private final Set<String> disallowedSignatureMethods;
/** Whether an empty reference is permitted. */
private final boolean emptyReferencePermitted;
@@ -81,26 +81,26 @@ public final class XMLSignatureValidator {
* Constructor.
*
* @param key public key with which to verify signatures
- * @param blacklistDigests set of blacklisted digest algorithm URIs, or <code>null</code>
- * @param blacklistSignatureMethods set of blacklisted signature method URIs, or <code>null</code>
+ * @param disallowDigests set of disallowed digest algorithm URIs, or <code>null</code>
+ * @param disallowSignatureMethods set of disallowed signature method URIs, or <code>null</code>
* @param emptyRefPermitted true if empty references are permitted
*/
- public XMLSignatureValidator(@Nonnull final PublicKey key, @Nullable final Set<String> blacklistDigests,
- @Nullable final Set<String> blacklistSignatureMethods,
+ public XMLSignatureValidator(@Nonnull final PublicKey key, @Nullable final Set<String> disallowDigests,
+ @Nullable final Set<String> disallowSignatureMethods,
final boolean emptyRefPermitted) {
Constraint.isNotNull(key, "public key can not be null");
verificationKey = key;
- if (blacklistDigests != null) {
- blacklistedDigests = new HashSet<>(blacklistDigests);
+ if (disallowDigests != null) {
+ disallowedDigests = new HashSet<>(disallowDigests);
} else {
- blacklistedDigests = Collections.emptySet();
+ disallowedDigests = Collections.emptySet();
}
- if (blacklistSignatureMethods != null) {
- blacklistedSignatureMethods = new HashSet<>(blacklistSignatureMethods);
+ if (disallowSignatureMethods != null) {
+ disallowedSignatureMethods = new HashSet<>(disallowSignatureMethods);
} else {
- blacklistedSignatureMethods = Collections.emptySet();
+ disallowedSignatureMethods = Collections.emptySet();
}
emptyReferencePermitted = emptyRefPermitted;
@@ -223,22 +223,22 @@ public final class XMLSignatureValidator {
final Reference ref = extractReference(signature);
markIdAttribute(docElement, ref);
- // check reference digest algorithm against blacklist
+ // check reference digest algorithm against list of disallowed algorithms
try {
final String alg = ref.getMessageDigestAlgorithm().getAlgorithmURI();
- LOG.debug("blacklist checking digest {}", alg);
- if (blacklistedDigests.contains(alg)) {
- throw new ValidationException("Digest algorithm " + alg + " is blacklisted");
+ LOG.debug("checking whether digest {} is allowed", alg);
+ if (disallowedDigests.contains(alg)) {
+ throw new ValidationException("Digest algorithm " + alg + " is disallowed");
}
} catch (final XMLSignatureException e) {
throw new ValidationException("unable to retrieve signature digest algorithm");
}
- // check signature algorithm against blacklist
+ // check signature algorithm against list of disallowed algorithms
final String alg = signature.getSignedInfo().getSignatureMethodURI();
- LOG.debug("blacklist checking signature method {}", alg);
- if (blacklistedSignatureMethods.contains(alg)) {
- throw new ValidationException("Signature algorithm " + alg + " is blacklisted");
+ LOG.debug("checking whether signature method {} is allowed", alg);
+ if (disallowedSignatureMethods.contains(alg)) {
+ throw new ValidationException("Signature algorithm " + alg + " is disallowed");
}
if (LOG.isDebugEnabled()) {
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdrpi/RegistrationAuthorityItemIdentificationStrategy.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdrpi/RegistrationAuthorityItemIdentificationStrategy.java
index 13c2761..c26a2de 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdrpi/RegistrationAuthorityItemIdentificationStrategy.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/mdrpi/RegistrationAuthorityItemIdentificationStrategy.java
@@ -37,7 +37,7 @@ import net.shibboleth.shared.collection.CollectionSupport;
*
* The extra identifier is based on a {@link RegistrationAuthority} if one of
* those is present. The extra identifier is omitted if it is present in a
- * specified blacklist, and it can be mapped to a simpler value for display if
+ * specified list, and it can be mapped to a simpler value for display if
* desired.
*
* @param <T> type of {@link Item} to be identified
diff --git a/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureValidationStageTest.java b/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureValidationStageTest.java
index 0460f93..2a27242 100644
--- a/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureValidationStageTest.java
+++ b/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureValidationStageTest.java
@@ -171,11 +171,11 @@ public class XMLSignatureValidationStageTest extends BaseDOMTest {
final Item<Element> result = mdCol.iterator().next();
- // There should not have been one error, mentioning blacklisting.
+ // There should not have been one error, mentioning that an algorithm is disallowed.
final List<ErrorStatus> errors = result.getItemMetadata().get(ErrorStatus.class);
Assert.assertEquals(errors.size(), 1);
final String message = errors.get(0).getStatusMessage();
- Assert.assertTrue(message.contains("blacklist"));
+ Assert.assertTrue(message.contains("disallowed"));
}
/**
@@ -205,11 +205,11 @@ public class XMLSignatureValidationStageTest extends BaseDOMTest {
final Item<Element> result = mdCol.iterator().next();
- // There should not have been one error, mentioning blacklisting.
+ // There should not have been one error, mentioning that the algorithm is disallowed.
final List<ErrorStatus> errors = result.getItemMetadata().get(ErrorStatus.class);
Assert.assertEquals(errors.size(), 1);
final String message = errors.get(0).getStatusMessage();
- Assert.assertTrue(message.contains("blacklist"));
+ Assert.assertTrue(message.contains("disallowed"));
}
/**
diff --git a/mda-keylists-rsa-legacy/src/main/resources/net/shibboleth/metadata/keylists/rsa/legacy/compromised-1024.txt b/mda-keylists-rsa-legacy/src/main/resources/net/shibboleth/metadata/keylists/rsa/legacy/compromised-1024.txt
index a5339fc..6016aa3 100644
--- a/mda-keylists-rsa-legacy/src/main/resources/net/shibboleth/metadata/keylists/rsa/legacy/compromised-1024.txt
+++ b/mda-keylists-rsa-legacy/src/main/resources/net/shibboleth/metadata/keylists/rsa/legacy/compromised-1024.txt
@@ -5,12 +5,12 @@
#
# openssl rsa -noout -modulus -in /tmp/key.pem | sha1sum | cut -d ' ' -f 1
#
-# You can also derive a new blacklist value from an X.509 certificate as follows:
+# You can also derive a new value from an X.509 certificate as follows:
#
# openssl x509 -noout -modulus -in /tmp/cert.pem | sha1sum | cut -d ' ' -f 2
#
# In either case, you should then remove the first 20 characters; in other words,
-# the blacklist line should be the lower 80 bits of the fingerprint).
+# the line should be the lower 80 bits of the fingerprint).
#
# simpleSAMLphp example key, shipped up to version 1.11
diff --git a/mda-keylists-rsa-legacy/src/main/resources/net/shibboleth/metadata/keylists/rsa/legacy/debian-1024.txt b/mda-keylists-rsa-legacy/src/main/resources/net/shibboleth/metadata/keylists/rsa/legacy/debian-1024.txt
index 0d4f5db..d7e4709 100644
--- a/mda-keylists-rsa-legacy/src/main/resources/net/shibboleth/metadata/keylists/rsa/legacy/debian-1024.txt
+++ b/mda-keylists-rsa-legacy/src/main/resources/net/shibboleth/metadata/keylists/rsa/legacy/debian-1024.txt
@@ -2,7 +2,7 @@
# modulus checksum:
# openssl rsa -noout -modulus -in /tmp/key.pem | sha1sum | cut -d ' ' -f 1)
# with the first 20 characters removed (that is, the lower 80 bits of the
-# fingerprint). Unless these rules are followed, the blacklist will not work
+# fingerprint). Unless these rules are followed, the list will not work
# properly. See openssl-vulnkey(1).
00005890bc78bcbee3ca
00005c9c49fd31e889a3
diff --git a/mda-keylists-rsa-legacy/src/main/resources/net/shibboleth/metadata/keylists/rsa/legacy/debian-512.txt b/mda-keylists-rsa-legacy/src/main/resources/net/shibboleth/metadata/keylists/rsa/legacy/debian-512.txt
index 9b44c51..425c9aa 100644
--- a/mda-keylists-rsa-legacy/src/main/resources/net/shibboleth/metadata/keylists/rsa/legacy/debian-512.txt
+++ b/mda-keylists-rsa-legacy/src/main/resources/net/shibboleth/metadata/keylists/rsa/legacy/debian-512.txt
@@ -2,7 +2,7 @@
# modulus checksum:
# openssl rsa -noout -modulus -in /tmp/key.pem | sha1sum | cut -d ' ' -f 1)
# with the first 20 characters removed (that is, the lower 80 bits of the
-# fingerprint). Unless these rules are followed, the blacklist will not work
+# fingerprint). Unless these rules are followed, the list will not work
# properly. See openssl-vulnkey(1).
000008127c5dea5c1fa8
000018bda998874252b8
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list