Skip to content
This repository


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Fetching contributors…

Cannot retrieve contributors at this time

file 428 lines (359 sloc) 22.934 kb
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428
Changelog for "Apache xml-security" <>

New in v1.5.2:
    Fixed SANTUARIO-313 - Javadocs warnings.
    Fixed SANTUARIO-309 - Default XMLCipher canonicalizer may decrypt element to the wrong namespace.
    Fixed SANTUARIO-308 - Canonicalizer error when encrypting multiple elements.
    Fixed SANTUARIO-310 - Implement KeyResolvers for PrivateKeys and SecretKeys.
    Fixed SANTUARIO-305 - No way to register internal key resolvers in DECRYPT_MODE.
    Fixed SANTUARIO-306 - KeySelectors loop
    Fixed SANTUARIO-304 - No way to distinguish DataReference from a KeyReference when iterating a ReferenceList
    Fixed SANTUARIO-302 - Need API to martial an independent ReferenceList.
    Fixed SANTUARIO-301 - Missing KeyInfo element when encrypting multiple elements.

New in v1.5.1:
    Fixed SANTUARIO-300 - decryption/encryption optimization.
    Fixed SANTUARIO-296 - XMLSignatureInput fails with an IOException if constructed on a BufferedInputStream
    Fixed SANTUARIO-298 - Xalan is still a required dependency
    Fixed SANTUARIO-299 - StringIndexOutOfBoundsException is thrown during reference verification (if URI = "#")
    Fixed SANTUARIO-297 - Exceptions should use a JDK exception cause mechanism

New in v1.5.0:
    Fixed SANTUARIO-295: XMLDSig XPathFilter2Transform bug involving intersect filter
    Fixed SANTUARIO-282: RSA-OAEP key transport is limited to SHA-1 digests.
    Fixed SANTUARIO-293: Support XML Encryption 1.1 Key Wrapping test-cases.
    Fixed SANTUARIO-292: Add the ability to access the dereferenced Elements after signature validation in the non-JSR-105 API.
    Fixed SANTUARIO-290: Add a secure validation switch for signature processing
    Fixed SANTUARIO-255: Port JSR 105 code to JDK 1.5.
    Fixed SANTUARIO-288: Add support for GCM algorithms via a third-party Crypto provider.
    Fixed SANTUARIO-287: Rename package in the 1.5 release.
    Fixed SANTUARIO-284: ElementProxy#getTextFromChildElement() doesn't get all of the text if the element contains an entity like &amp;
    Fixed SANTUARIO-273: xml:base attribute not processed correctly in C14N11 canonicalization.
    Fixed SANTUARIO-260: Review logging
    Fixed SANTUARIO-257: Use JUnit4 for testing
    Fixed SANTUARIO-256: Port non-JSR 105 code to use JDK 1.5.
    Fixed SANTUARIO-269: Register default algorithms/implementations dynamically.
    Fixed SANTUARIO-283: JSR105 does not retain namespace definitions on Object element when unmarshalling
    Fixed SANTUARIO-254: Rework
    Fixed SANTUARIO-248: Add support for ECDSA signature with SHA-2 message digests + enhancements in ASN.1 to XMLDSIG converter (and viceversa)

New in v.1.4.6
    Fixed SANTUARIO-284: ElementProxy#getTextFromChildElement() doesn't get all of the text if the element contains an entity like &amp;
    Fixed SANTUARIO-283: JSR105 does not retain namespace definitions on Object element when unmarshalling
    Fixed SANTUARIO-281: Invalid signature value when using XMLSignature in two EJB modules on AS
    Fixed SANTUARIO-102: Private keys must be instance of RSAPrivate or have PKCS#8 encoding
    Fixed SANTUARIO-273: xml:base attribute not processed correctly in C14N11 canonicalization.

New in v1.4.5
    Fixed SANTUARIO-250: VerifyMerlinsExamplesFifteen/ samples should ignore signature-enveloping-hmac-sha1-40.xml
    Fixed SANTUARIO-191: xml:id attributes are not correctly handled when using c14n11.
    Fixed SANTUARIO-266: c14n11 produces different signatures using version 1.4.3 and 1.4.4.
    Fixed SANTUARIO-253: is not thread safe.
    Fixed SANTUARIO-263: Canonicalizer can't handle dynamical created DOM correctly. Thanks to Martin Koegler.
    Fixed SANTUARIO-262: Invalid use of String.getBytes(). Thanks to Martin Koegler.

New in v1.4.4
    Fixed Bug 50248: Concurrency problem on incomplete Init.init() calls. Thanks to Oliver Moehrke.
    Fixed Bug 50215: test_jsr105 target appears to fail certain tests because of changes to W3C xml-stylesheet spec

New in v1.4.4-SNAPSHOT
    Fixed Bug 50122: JSR 105 TransformService classloading issue
    Fixed Bug 40897: String comparisons using '==' causes validation errors with some parsers.
    Fixed Bug 50050: UnsyncByteArrayOutputStream throws ArrayIndexOutOfBoundsException if array length > internal buffer expansion size.
    Fixed Bug 50036: IdResolver Java API extension. Thanks to Stefan Vladov.
    Fixed Bug 49493: Cannot resolve PrivateKeys used in Key Transport algorithms. Thanks to Clement Pellerin.
    Fixed Bug 49577: DOMSubTreeData allows for only one iteration over referenced data.
    Fixed Bug 49692: Xmlsec 1.4.3 not compatible with xmlbeans 2.4.0.
    Fixed Bug 49629: Some changes to the build system.
    Fixed Bug 49483: KeyResolver.registerAtStart() leads to ClassCastException. Thanks to Clement Pellerin.
    Fixed Bug 49458: StorageResolver always exhausted after first use. Thanks to Clement Pellerin.
    Fixed Bug 49456: gives ClassCastException. Thanks to Clement Pellerin.
    Fixed Bug 49450: KeyStoreResolver always exhausted after first use. Thanks to Clement Pellerin.
    Fixed Bug 49447: KeyStoreResolver iterator returns null for symmetric keys. Thanks to Clement Pellerin.
    Fixed Bug 48368: Digest Value of References inside Manifest - calculation order problem
    Fixed Bug 47779: ConcurrentModificationException in XMLUtils.
    Fixed Bug 47761: xmlns:xml namespace improperly emitted during excl c14n. Thanks to Scott Cantor.
    Fixed Bug 36526: Out of memory error when signing or verifying big files. Thanks to Agnes Juhasz.
    Fixed Bug 47784: ClassNotFoundException when init the xml security in OSGi plateform
    Fixed Bug 47762: contextChild parameter of Transform.getInstance may be null
New in v1.4.3
    Fixed Bug 47526: XML signature HMAC truncation authentication bypass
    Fixed Bug 47525: Fix checkstyle problems with source and tests.
    Fixed Bug 42239: ECDSA signature value interopability patch.
    Fixed Bug 45744: XPath transform and xml-stylesheet.
    Fixed Bug 42986: The </#document> node inserted at the end of SOAPEnvelope.
    Fixed Bug 47029: Unnecessary namespace declarations on EncryptedData children.
    Fixed Bug 44335: Can't validate after invalid validation.
    Fixed Bug 47260: Improve Java unit testing.
    Fixed Bug 47265: Some website updates.
    Fixed Bug 45388: We need a POM file added to the Maven repository.
    Fixed Bug 47483: Remove JDK 1.5 API dependencies
    Fixed bug 47057: Downgrade signature verification logging from "info". Thanks to Colm O hEigeartaigh.
    Fixed bug 42061: Method to disable XMLUtils.addReturnToElement (reopened): changed Base64 code to ignore line breaks, if enabled. Thanks to Colm O hEigeartaigh.
    Fixed bug 47097: Reusing XMLSignature for signing and verifying fails on same thread. Thanks to Bruno Harbulot.
    Fixed bug 46732: Failed to add more than one child element to EncryptionMethod.
    Fixed bug 46101: is not thread safe
    Fixed bug 45961: verify with own canonicalization method. Thanks to Anton Kosyakov.
    Fixed bug 45475: XMLSignature::getKeyInfo method modifies document
    Fixed bug 45811: Fix XMLSec 1.4.2 problems reported by findbugs
    Fixed bug 45706: Transform.register class loading and recursive instantiation problems
    Fixed bug 45664: Some calls should be wrapped in AccessController.doPrivileged
    Fixed bug 45634: Restore XMLUtils.createDSctx method.
    Fixed bug 45095: in xmlsec sources and builds has side
effects in production environment. Thanks to Joachim Rousseau.

New in v1.4.2rc1
    Fixed bug 44999: DOMException is thrown at XMLSignature creation. Thanks to Giedrius Noreikis.
    Fixed bug 44863: Improved logging in signature handling. Thanks to Wally Dennis.
    Fixed bug 44956: Concurrent creation of a XMLSignature instance produces an ArrayIndexOutOfBoundsException. Thanks to Giedrius Noreikis
    Fixed bug 44991: Concurrent invocation of KeyInfo.getX509Certificate() occasionally fails. Thanks to Giedrius Noreikis
New in v1.4.2beta2
    Fixed bug 44810: Add support for more XMLDSig algorithms listed in RFC 4051
    Fixed bug 44617: Regression when processing XPath transform (additional fix)
New in v1.4.2beta1
    Fixed bug 44629: Switch order of XML Signature validation steps
    Fixed bug 44617: Regression when processing XPath transform
    Fixed bug 44586: XMLX509IssuerSerial.getIssuerName incorrectly escapes '#' in hex values
    Fixed rfe 42653: Add support for C14N 1.1 to Java implementation. Thanks
to Sean Mullan.
    Fixed bug 44205: XMLX509Certificate.getX509Certificate() results in certificate parsing error. Thanks to Vishal Mahajan.
    Fixed Bug 44177: when using xslt transformation there is problem with xalan newline. Thanks to Matej Spiller.
    Small refactor for ElementProxy to get rid of the state, it was an old
        vestige that where taking space and obfuscating the code.
    Fixed bug 40897: String comparisons using '==' causes validation errors
        with some parsers. Thanks Vishal Mahajan
    Fixed bug 43056: Library does not allow specify provider for private key
operations. Thanks to Alon Bar-Lev.
    Fixed bug 44102: XMLCipher loadEncryptedKey error. Thanks to Butler.
    Fixed bug 43239: "No installed provider supports this key" when checking a
RSA signature against a DSA key before RSA key. Thanks to Matthias
    Fixed bug 42597: Unnecessary namespace declarations on Signature children
Thanks to Brent Putnam.
    Fixed bug 42061: Method to disable XMLUtils.addReturnToElement. Thanks to
Michael McIntosh.
    Fixed bug 42865: Problem with empty BaseURI in ResolverLocalFilesystem.
Thanks to Frank Cornelis.
    Fixed bug 43230: Inclusive C14n doesn't always handle xml:space & xml:lang
attributes correctly
    Fixed bug 38668: Add XMLCipher.encryptData method that takes serialized
data as parameter. Thanks to Vladimir Ionescu.
    Fixed bug 42886: Error when removing encrypted content in 1.4.1. Thanks to
Julien Taupin and Daniele Gagliardi.
    Fixed bug 42820: ClassLoader issue causing NoSuchAlgorithmException loading
Provider Implementation. Thanks to James Washington.
New in 1.4.1
    Fixed bug 42239: ECDSA signature value interoperability patch. Thanks to Wolfgang Glas for fix.

New in v1.4.1beta1
    Fixed bug 41892: XML Security 1.4.0 does not build with IBM's JDK
    Fixed bug 41927: Cannot canonicalize with XSLT transform. Thanks to
Lijun Liao for fix.
    Fixed bug 41805: Resolution of SAML 1.x ID attributes, incorrect namespace. Thanks to
Brent Putman for fix.
    Fixed bug 41474: two text nodes with the value '\n' in succession within
        <ds:SignedInfo> and <ds:X509IssuerSerial>. Thanks to Lijun Liao for fix.
    Fixed bug 41510:
        returns null for DSA key. Thanks to Stepan Hrbacek for fix.
    Fixed bug 41569: Cannot specify dynamically a specific JCE Provider with
        the DSA Signature. Thanks to Julien Pasquier for fix.
    Fixed bug 41573: XMLCipher StackOverflowError. Thanks to Marek Jablonski
        for fix.
    Fixed bug 41462: Xml canonization - UTF-8 encoding issue in Xml security 1.4.0 Thanks to Karol Rewera.
    Fixed bug 41520: Cannot generate signatures with the same key but different algorithms in sucession. Thanks to Lijun Liao
New in 1.4
Fixed bug 40896

New in 1.4RC4
Fixed bug 40880

New in 1.4RC3
Fixed bug 40796

New in 1.4RC2a
    Fixed bug 40783

New in 1.4RC2
Fixed bug 40512. Made TransformSPI backward compatible. Now it is possible
to use implementations for the >1.3 versions paying the performance hit
of the old implementation.
    Fix a small & unneeded java 1.4 dependecy.
    KeyResolver & ResourceResolver can work like <1.3 mode when used with old implementations.

New in 1.4RC1
Fixed bug 40290.
Fixed bug 40298.
Fixed bug 40360. Changed a little the way the IdResolver works when
Document.getElementById fails.
Fixed bug 40404.

New in v1.4beta2
    Optimization in c14n in node-sets.
Optimization for the xml:* inheritance in inclusive c14n.
Added ECDSA signature thanks Markus Lindner
Optimization in RetrievelMethod handling. Don't reparse the bytes into a DOM tree if not needed thanks David Garcia.
Fixed bug 40215: Base64 is not working in EBCDIC platform. Thanks to for fix.
Big optimizations in XPath2 transformation.
Fixed bug 40245 in XPATH2 transformation(only in development version)
Fixed bug no resolver for X509Data with just a X509Certificate.
Optimization in Base64 to do simple transformation from String to byte[]

New in v1.4beta1
    Fixed bug 40032. Fixed BUG 40031 Fixed bug when the prefix digital signature uri is not null.
Changes in the NodeFilter API in order to let the transformations
         do some optimizations take into account the c14n order.
Optimization in signature transformation in node-sets(xpath, xpath2), 20-40% speed-up.

New in v1.4beta0
Fixed bug 38668: Add XMLCipher.encryptData method that takes
serialized data as parameter (mullan)
Fixed bug 39273: JSR 105 DOMCryptoContext.setIdAttributeNS not working
when validating signatures (mullan)
Fixed bug 38405: ElementProxy.length() is not working (Java) (mullan)
Fixed bug 37708: Different behaviour with NodeSet and RootNode with
InclusiveNamespaces (mullan)
Fixed bug 37456: Signing throws an exception if custom resource
resolver is registered (mullan)
        Fixed bug 38655
Fixed bug 38444.
Fixed bug 38605.
Fixed bug 39200(API CHANGE)
Refactored the way keyresolver works instead of calling canResolve/resolveX only resolveX is used
and if it returns null it means it cannot resolve.
Minor Optimizations.
Lazy fields initialization, initialize with null and create the object only when needed
Registered Class reorder, in several parts the library contains a list of workers
that are asked if it can solve a problem. Now the one that said yes is move to the front
wishing that the next time it also hits.
API Change: Make Transform & TransformSpi reusable between threads.
remove setTransform(Transform t) method in TransformSpi and pass
the Transform object in enginePerformTransfor methods.
Fixed bug 39685: bugs reported by findbugs (mullan)
Added support for SHA256 & SHA512 DigestMethods to JSR 105. (mullan)
Fix JSR 105 unmarshaling bug: now recognizes PGPData. (mullan)
Optimization to not create instances of Signature or MessageDigest objects, but mantain one for thread.
Also don't change the key if it was already used. (raul)

New in v1.3
Init-Don't fail if a transformation don't have all of its dependecies.
Remove XPath initialization from Init and do only when xpath is needed.
    Resolv-Removed the use of xpath expressions to search the elements to sign/verify, now use only plain DOM searching.
Resolvers-Remove wantsOctectStream wantsNodeSet and his returns pair they are not used, right now and some are incorrect.
Remove the Use of xalan or xerces class URI
Removed the expandSystemId
Changed from Vector<String> to List<Class>, so we don't need to use classForName everytime and used it just the first time.
Removed PRNG,HexDump,Version, X509CertificateValidator
Added an unsync buffer outputstream.
Changed Symbol table to a more efficient and simple structure
Fixed bug 34743 , Submitted by: Lee Coomber <>
Minor speedups in b64, Halved the table lookups.
Reduce Object creation during c14n, from one to level to one per c14n.
Change all Vector to List(ArrayList), we don't need synchronization safety.
*Refactor the way we handle c14n of nodesets:
Before this patch every transformation creates a set with the nodes that should
be outputed. Every set is obtaining visiting the whole dom tree every time,
and then do it other time at c14n time. So it does <number of transformations>+1
visitings, very slow and memory costly.
Now every transformation just return a NodeFilter that tells if the node is included or not.
So only one visiting is done.
Unified and transformation implementations.
Removed transformation
Canonicalization tree travesing is not recursive. it gives better memory handling and performance.
Fixed bug 33936, Submited by: Raymond Wong <>
Fixed bug 35919, Submited by: Luda <>
out of the box j2se 1.5 ready(no adding xalan in the classpath or endorsed if no
xpath transformation is needed)

New in v1.2.1
 * Fix the memory leak when using xpath or using ResourceResolver and not hitting
   getElementByIdUsingDOM() []
 * Fix the bug with using XPath2Filter and inclusive c14n
 * Fix the bug arrouse in reusing Canonicalizers
 * Fix base64transformation bug [ ]
 * Fix the XMLsignatureInput reset() bug.
 * Clean unused jar (xmlParserAPI.jar,etc) and check and stored new versions.
 * generated the dist jar with version (i.e. xmlsec-1.2.1.jar instead of plain xmlsec.jar)
 * Clean unused build*.xml files.

# New in v1.0.3 24. May 2002


 - The different classes do not call Init.init() any longer. This must be done
   by YOU in your application. If you miss that, you'll get many
   AlgorithmNotRegistered exceptions...


 - The software is faster. Especially canonicalization is between
   factor 5--80 faster than the old one.
 - Some deprecated methods in the Canonicalizer are deleted.
 - We support Exclusive Canonicalization
 - We support the XPath Filter version 2.0 Draft.


Optimizations and speed-up

 - canonicalization
   - inclusive c14n is now faster (factor between 5 and 80)
 - transforms
   - enveloped-signature is now faster (no XPath ops any more)
   - base64 is now faster (no XPath ops any more)
   - c14n is now faster (due to faster c14n algo)


Signature package:

 - The XMLSignatureInput which is used for passing node sets and octet
   streams into transforms and which is also the result of transforms
   uses a java.util.Set now instead of a NodeList for the internal
   representation of xpath node sets. This allows easier queries in the
   form: Is node N part of the node set.
   The implication is that you can also pass a Set which contains the nodes
   to be canonicalized to the Canonicalizers using
   public byte[] canonicalizeXPathNodeSet(Set xpathNodeSet)



 - A bug (well, my understanding of c14n) is corrected regarding the
   canonicalization of node sets. That bug related to the xml:*
   attributes. See xmldsig mailing list archive @ for details.

 - removed are the methods

   - public byte[] canonicalize(Node node)
   - public byte[] canonicalizeDocument(Document doc)
   - public byte[] canonicalizeSingleNode(Node rootNode)

     replaced by public byte[] canonicalizeSubtree(Node node)

   - public byte[] canonicalize(NodeList xpathNodeSet)

     replaced by public byte[] canonicalizeXPathNodeSet(NodeList xpathNodeSet)
   - public void setXPath(Object xpath)
   - public Object getXPath()
   - public String getXPathString()
   - public void setXPathNodeSet(NodeList nodeList)
     These are no longer in use. If you want to c14nize an xpath
     node set, select it using CachedXPathAPI and then apply
     canonicalizeXPathNodeSet to the node set.
   - public void setRemoveNSAttrs(boolean remove)
   - public boolean getRemoveNSAttrs()
     The c14nizers do not add any attributes (namespaces or xml:*)
     to the document, so these method make no sense.
 - The Canonicalizer now supports "Exclusive XML Canonicalization
   Version 1.0" <>, Rev 1.58.
   For that reason, the c14n methods allow an additional String parameter
   for passing the inclusive namespaces.
   public byte[] canonicalizeSubtree(Node node,
                                     String inclusiveNamespaces)
   public byte[] canonicalizeXPathNodeSet(NodeList xpathNodeSet,
                                          String inclusiveNamespaces)
   Such a string looks e.g. like this
     String inclusiveNamespaces = "ds xenc ex #default";
   For more on exclusive c14n, see the spec. If you pass this parameter to the
   regular (inclusive) c14nizer, you'll get a

 - The exclusive c14n is also supported by the transform framework.
   The parameter for the inclusive namespaces is the class
   If you want to make a Transform like this, do that:
   Document doc = ...;
   Transforms transforms = new Transforms(doc);
   InclusiveNamespaces incNS = new InclusiveNamespaces(doc, "ns2");
 - The XPathContainer for the XPath transform is now moved from the package to

 - The enveloped-signature transform is faster now. We don't do costly
   XPath operations but 'simple' DOM ops.

 - Base64 is faster (no XPath ops).

 - The TransformXPath2Filter is now supported by the package. It can be used by
   using the identifier Transforms.TRANSFORM_XPATH2FILTER in conjuction with the
   XPath2FilterContainer for passing parameters. To know what xfilter2 is, see :

   Document doc = ...;
   Transforms transforms = new Transforms(doc);
   XPath2FilterContainer x2c =
         // intersect
         XPath2FilterContainer.newInstanceIntersect(doc, "//a");
         // subtract
         XPath2FilterContainer.newInstanceSubtract(doc, "//a");
         // union
         XPath2FilterContainer.newInstanceUnion(doc, "//a");
Something went wrong with that request. Please try again.