[java-metadata-aggregator] branch main updated: MDA-245 - Terminology changes
Ian Young
ian at iay.org.uk
Wed May 8 15:34:06 UTC 2024
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch main
in repository java-metadata-aggregator.
View the commit online:
http://git.shibboleth.net/view/?p=java-metadata-aggregator.git;a=commit;h=73cd6baaef8e2fb0db2908d121941a5d59288e9a
The following commit(s) were added to refs/heads/main by this push:
new 73cd6ba MDA-245 - Terminology changes
73cd6ba is described below
commit 73cd6baaef8e2fb0db2908d121941a5d59288e9a
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Wed May 8 16:34:03 2024 +0100
MDA-245 - Terminology changes
https://shibboleth.atlassian.net/browse/MDA-245
---
.../metadata/dom/XMLSignatureValidationStage.java | 102 +++++++++++++++++----
.../dom/XMLSignatureValidationStageTest.java | 91 ++++++++++++++----
2 files changed, 156 insertions(+), 37 deletions(-)
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java
index 027cce6..b334c4e 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidationStage.java
@@ -41,7 +41,9 @@ import net.shibboleth.shared.annotation.constraint.Unmodifiable;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.DeprecationSupport;
import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.DeprecationSupport.ObjectType;
import net.shibboleth.shared.xml.SerializeSupport;
/**
@@ -53,12 +55,16 @@ import net.shibboleth.shared.xml.SerializeSupport;
* <li><code>verificationKey</code></li>
* </ul>
*
+ * <p>
* If Element signatures are required, per {@link #signatureRequired}, and an Element does not contain a signature than
* an {@link ErrorStatus} object is set on the Element.
+ * </p>
*
+ * <p>
* If Element signatures are required to be valid, per {@link #isValidSignatureRequired()}, and an Element signature is
* found to be invalid than an {@link ErrorStatus} object is set on the element. If signatures are not required to be
* valid and an Element signature is found to be invalid than an {@link WarningStatus} is set on the Element.
+ * </p>
*/
@ThreadSafe
public class XMLSignatureValidationStage extends AbstractStage<Element> {
@@ -82,13 +88,13 @@ public class XMLSignatureValidationStage extends AbstractStage<Element> {
@NonnullAfterInit @GuardedBy("this")
private PublicKey verificationKey;
- /** Set of blacklisted digest URIs. Default value: empty set. */
+ /** Set of disallowed digest URIs. Default value: empty set. */
@Nonnull @NonnullElements @Unmodifiable @GuardedBy("this")
- private Set<String> blacklistedDigests = CollectionSupport.emptySet();
+ private Set<String> disallowedDigests = CollectionSupport.emptySet();
- /** Set of blacklisted signature method URIs. Default value: empty set. */
+ /** Set of disallowed signature method URIs. Default value: empty set. */
@Nonnull @NonnullElements @Unmodifiable @GuardedBy("this")
- private Set<String> blacklistedSignatureMethods = CollectionSupport.emptySet();
+ private Set<String> disallowedSignatureMethods = CollectionSupport.emptySet();
/** Option to determine whether empty references are to be permitted. Default value: <code>true</code>. */
@GuardedBy("this")
@@ -173,43 +179,101 @@ public class XMLSignatureValidationStage extends AbstractStage<Element> {
}
/**
- * Set the collection of identifiers to be blacklisted as digest algorithms.
+ * Set the collection of identifiers to be disallowed as digest algorithms.
*
- * @param identifiers collection of identifiers to be blacklisted
+ * @param identifiers collection of identifiers to be disallowed
+ *
+ * @since 0.10.0
*/
- public synchronized void setBlacklistedDigests(
+ public synchronized void setDisallowedDigests(
+ @Nonnull @NonnullElements @Unmodifiable final Collection<String> identifiers) {
+ checkSetterPreconditions();
+ disallowedDigests = CollectionSupport.copyToSet(identifiers);
+ }
+
+ /**
+ * Gets the set of disallowed digest algorithm identifiers.
+ *
+ * @return the set of disallowed digest algorithm identifiers
+ *
+ * @since 0.10.0
+ */
+ @Nonnull @NonnullElements @Unmodifiable public final synchronized Set<String> getDisallowedDigests() {
+ return disallowedDigests;
+ }
+
+ /**
+ * Set the collection of identifiers to be disallowed as signature methods.
+ *
+ * @param identifiers collection of identifiers to be disallowed
+ *
+ * @since 0.10.0
+ */
+ public synchronized void setDisallowedSignatureMethods(
@Nonnull @NonnullElements @Unmodifiable final Collection<String> identifiers) {
checkSetterPreconditions();
- blacklistedDigests = CollectionSupport.copyToSet(identifiers);
+ disallowedSignatureMethods = CollectionSupport.copyToSet(identifiers);
+ }
+
+ /**
+ * Gets the set of disallowed signature method identifiers.
+ *
+ * @return the set of disallowed signature method identifiers
+ *
+ * @since 0.10.0
+ */
+ @Nonnull @NonnullElements @Unmodifiable public final synchronized Set<String> getDisallowedSignatureMethods() {
+ return disallowedSignatureMethods;
+ }
+
+ /**
+ * Set the collection of identifiers to be disallowed as digest algorithms.
+ *
+ * @param identifiers collection of identifiers to be disallowed
+ */
+ @Deprecated(since="0.10.0", forRemoval=true)
+ public synchronized void setBlacklistedDigests(
+ @Nonnull @NonnullElements @Unmodifiable final Collection<String> identifiers) {
+ DeprecationSupport.warnOnce(ObjectType.METHOD, "setBlacklistedDigests",
+ "XMLSignatureValidationStage", "setDisallowedDigests");
+ setDisallowedDigests(identifiers);
}
/**
- * Gets the set of blacklisted digest algorithm identifiers.
+ * Gets the set of disallowed digest algorithm identifiers.
*
- * @return the set of blacklisted digest algorithm identifiers
+ * @return the set of disallowed digest algorithm identifiers
*/
+ @Deprecated(since="0.10.0", forRemoval=true)
@Nonnull @NonnullElements @Unmodifiable public final synchronized Set<String> getBlacklistedDigests() {
- return blacklistedDigests;
+ DeprecationSupport.warnOnce(ObjectType.METHOD, "getBlacklistedDigests",
+ "XMLSignatureValidationStage", "getDisallowedDigests");
+ return getDisallowedDigests();
}
/**
- * Set the collection of identifiers to be blacklisted as signature methods.
+ * Set the collection of identifiers to be disallowed as signature methods.
*
- * @param identifiers collection of identifiers to be blacklisted
+ * @param identifiers collection of identifiers to be disallowed
*/
+ @Deprecated(since="0.10.0", forRemoval=true)
public synchronized void setBlacklistedSignatureMethods(
@Nonnull @NonnullElements @Unmodifiable final Collection<String> identifiers) {
- checkSetterPreconditions();
- blacklistedSignatureMethods = CollectionSupport.copyToSet(identifiers);
+ DeprecationSupport.warnOnce(ObjectType.METHOD, "setBlacklistedSignatureMethods",
+ "XMLSignatureValidationStage", "setDisallowedSignatureMethods");
+ setDisallowedSignatureMethods(identifiers);
}
/**
- * Gets the set of blacklisted signature method identifiers.
+ * Gets the set of disallowed signature method identifiers.
*
- * @return the set of blacklisted signature method identifiers
+ * @return the set of disallowed signature method identifiers
*/
+ @Deprecated(since="0.10.0", forRemoval=true)
@Nonnull @NonnullElements @Unmodifiable public final synchronized Set<String> getBlacklistedSignatureMethods() {
- return blacklistedSignatureMethods;
+ DeprecationSupport.warnOnce(ObjectType.METHOD, "getBlacklistedSignatureMethods",
+ "XMLSignatureValidationStage", "getDisallowedSignatureMethods");
+ return getDisallowedSignatureMethods();
}
/**
@@ -285,7 +349,7 @@ public class XMLSignatureValidationStage extends AbstractStage<Element> {
final var key = getVerificationKey();
assert key != null;
final var validator = new XMLSignatureValidator(key,
- getBlacklistedDigests(), getBlacklistedSignatureMethods(), isPermittingEmptyReferences());
+ getDisallowedDigests(), getDisallowedSignatureMethods(), isPermittingEmptyReferences());
// Use it to validate each item in turn
for (final var item : items) {
diff --git a/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureValidationStageTest.java b/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureValidationStageTest.java
index 2a27242..698df57 100644
--- a/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureValidationStageTest.java
+++ b/mda-framework/src/test/java/net/shibboleth/metadata/dom/XMLSignatureValidationStageTest.java
@@ -17,23 +17,22 @@ package net.shibboleth.metadata.dom;
import java.io.IOException;
import java.security.cert.Certificate;
import java.util.ArrayList;
-import java.util.HashSet;
import java.util.List;
-import java.util.Set;
import javax.annotation.Nonnull;
+import org.cryptacular.util.CertUtil;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+import org.w3c.dom.Element;
+
import net.shibboleth.metadata.ErrorStatus;
import net.shibboleth.metadata.Item;
import net.shibboleth.metadata.WarningStatus;
import net.shibboleth.metadata.dom.testing.BaseDOMTest;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.xml.XMLParserException;
-import org.cryptacular.util.CertUtil;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-import org.w3c.dom.Element;
-
/** Unit test for {@link XMLSchemaValidationStage}. */
public class XMLSignatureValidationStageTest extends BaseDOMTest {
@@ -145,24 +144,21 @@ public class XMLSignatureValidationStageTest extends BaseDOMTest {
}
/**
- * Test digest algorithm blacklist.
+ * Test disallowed digest algorithm.
*
* @throws Exception if something bad happens
*/
@Test
- public void testDigestBlacklist() throws Exception {
+ public void testDisallowedDigest() throws Exception {
final DOMElementItem item = makeItem("signed.xml");
final List<Item<Element>> mdCol = new ArrayList<>();
mdCol.add(item);
- final Set<String> blacklist = new HashSet<>();
- blacklist.add("http://www.w3.org/2001/04/xmlenc#sha256");
-
final XMLSignatureValidationStage stage = new XMLSignatureValidationStage();
stage.setId("test");
stage.setVerificationCertificate(signingCert);
- stage.setBlacklistedDigests(blacklist);
+ stage.setDisallowedDigests(CollectionSupport.singleton("http://www.w3.org/2001/04/xmlenc#sha256"));
stage.initialize();
stage.execute(mdCol);
@@ -179,24 +175,83 @@ public class XMLSignatureValidationStageTest extends BaseDOMTest {
}
/**
- * Test signature method blacklist.
+ * Test disallowed signature method.
+ *
+ * @throws Exception if something bad happens
+ */
+ @Test
+ public void testDisallowedSignatureMethod() throws Exception {
+ final DOMElementItem item = makeItem("signed.xml");
+
+ final List<Item<Element>> mdCol = new ArrayList<>();
+ mdCol.add(item);
+
+ final XMLSignatureValidationStage stage = new XMLSignatureValidationStage();
+ stage.setId("test");
+ stage.setVerificationCertificate(signingCert);
+ stage.setDisallowedSignatureMethods(CollectionSupport.singleton("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"));
+ stage.initialize();
+
+ stage.execute(mdCol);
+ stage.destroy();
+ Assert.assertEquals(mdCol.size(), 1);
+
+ final Item<Element> result = mdCol.iterator().next();
+
+ // There should not have been one error, mentioning that the algorithm is disallowed.
+ final List<ErrorStatus> errors = result.getItemMetadata().get(ErrorStatus.class);
+ Assert.assertEquals(errors.size(), 1);
+ final String message = errors.get(0).getStatusMessage();
+ Assert.assertTrue(message.contains("disallowed"));
+ }
+
+ /**
+ * Test disallowed digest algorithm.
*
* @throws Exception if something bad happens
*/
@Test
- public void testSignatureMethodBlacklist() throws Exception {
+ public void testDisallowedDigestLegacy() throws Exception {
final DOMElementItem item = makeItem("signed.xml");
final List<Item<Element>> mdCol = new ArrayList<>();
mdCol.add(item);
- final Set<String> blacklist = new HashSet<>();
- blacklist.add("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
+ final XMLSignatureValidationStage stage = new XMLSignatureValidationStage();
+ stage.setId("test");
+ stage.setVerificationCertificate(signingCert);
+ stage.setBlacklistedDigests(CollectionSupport.singleton("http://www.w3.org/2001/04/xmlenc#sha256"));
+ stage.initialize();
+
+ stage.execute(mdCol);
+ stage.destroy();
+ Assert.assertEquals(mdCol.size(), 1);
+
+ final Item<Element> result = mdCol.iterator().next();
+ // There should not have been one error, mentioning that an algorithm is disallowed.
+ final List<ErrorStatus> errors = result.getItemMetadata().get(ErrorStatus.class);
+ Assert.assertEquals(errors.size(), 1);
+ final String message = errors.get(0).getStatusMessage();
+ Assert.assertTrue(message.contains("disallowed"));
+ }
+
+ /**
+ * Test disallowed signature method.
+ *
+ * @throws Exception if something bad happens
+ */
+ @Test
+ public void testDisallowedSignatureMethodLegacy() throws Exception {
+ final DOMElementItem item = makeItem("signed.xml");
+
+ final List<Item<Element>> mdCol = new ArrayList<>();
+ mdCol.add(item);
+
final XMLSignatureValidationStage stage = new XMLSignatureValidationStage();
stage.setId("test");
stage.setVerificationCertificate(signingCert);
- stage.setBlacklistedSignatureMethods(blacklist);
+ stage.setBlacklistedSignatureMethods(CollectionSupport.singleton("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"));
stage.initialize();
stage.execute(mdCol);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list