8275082: Update XML Security for Java to 2.3.0

src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/Init.java

@@ -349,6 +349,9 @@ private static void fileInit(InputStream is) {
      * @param callingClass The Class object of the calling object
      */
     public static URL getResource(String resourceName, Class<?> callingClass) {
+        if (resourceName == null) {
+            throw new NullPointerException();
+        }
         URL url = Thread.currentThread().getContextClassLoader().getResource(resourceName);
         if (url == null && resourceName.charAt(0) == '/') {
             //certain classloaders need it without the leading /
@@ -402,6 +405,9 @@ public static URL getResource(String resourceName, Class<?> callingClass) {
      * @param callingClass The Class object of the calling object
      */
     private static List<URL> getResources(String resourceName, Class<?> callingClass) {
+        if (resourceName == null) {
+            throw new NullPointerException();
+        }
         List<URL> ret = new ArrayList<>();
         Enumeration<URL> urls = new Enumeration<URL>() {
             public boolean hasMoreElements() {
@@ -477,7 +483,7 @@ public URL nextElement() {
         }
 
 
-        if (ret.isEmpty() && resourceName != null && resourceName.charAt(0) != '/') {
+        if (ret.isEmpty() && resourceName.charAt(0) != '/') {
             return getResources('/' + resourceName, callingClass);
         }
         return ret;

src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/algorithms/implementations/IntegrityHmac.java

@@ -309,7 +309,7 @@ protected void engineGetContextFromElement(Element element) throws XMLSignatureE
         Node n = XMLUtils.selectDsNode(element.getFirstChild(), Constants._TAG_HMACOUTPUTLENGTH, 0);
         if (n != null) {
             String hmacLength = XMLUtils.getFullTextChildrenFromNode(n);
-            if (hmacLength != null && !"".equals(hmacLength)) {
+            if (hmacLength != null && hmacLength.length() != 0) {
                 this.hmacOutputLength = new HMACOutputLength(Integer.parseInt(hmacLength));
             }
         }

src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/c14n/implementations/Canonicalizer20010315.java

@@ -125,7 +125,7 @@ public void engineCanonicalizeSubTree(
      * Output the Attr[]s for the given element.
      * <br>
      * The code of this method is a copy of
-     * {@link #outputAttributes(Element, NameSpaceSymbTable, Map)},
+     * {@link #outputAttributes(Element, NameSpaceSymbTable, Map, OutputStream)},
      * whereas it takes into account that subtree-c14n is -- well -- subtree-based.
      * So if the element in question isRoot of c14n, it's parent is not in the
      * node set, as well as all other ancestors.

src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/c14n/implementations/CanonicalizerBase.java

@@ -211,7 +211,7 @@ private void canonicalizeSubTree(
         Node sibling = null;
         Node parentNode = null;
         Map<String, byte[]> cache = new HashMap<>();
-        do {
+        do {    //NOPMD
             switch (currentNode.getNodeType()) {
 
             case Node.ENTITY_NODE :
@@ -338,7 +338,7 @@ private void canonicalizeXPathNodeSet(Node currentNode, Node endnode, OutputStre
         Node parentNode = null;
         int documentLevel = NODE_BEFORE_DOCUMENT_ELEMENT;
         Map<String, byte[]> cache = new HashMap<>();
-        do {
+        do {    //NOPMD
             switch (currentNode.getNodeType()) {
 
             case Node.ENTITY_NODE :
@@ -560,7 +560,7 @@ private void getParentNameSpaces(Element el, NameSpaceSymbTable ns)  {
         }
         parents.clear();
         Attr nsprefix = ns.getMappingWithoutRendered(XMLNS);
-        if (nsprefix != null && "".equals(nsprefix.getValue())) {
+        if (nsprefix != null && nsprefix.getValue().length() == 0) {
             ns.addMappingAndRender(
                     XMLNS, "", getNullNode(nsprefix.getOwnerDocument()));
         }

src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/c14n/implementations/CanonicalizerPhysical.java

@@ -110,7 +110,7 @@ public void engineCanonicalizeSubTree(
      * Output the Attr[]s for the given element.
      * <br>
      * The code of this method is a copy of
-     * {@link #outputAttributes(Element, NameSpaceSymbTable, Map)},
+     * {@link #outputAttributes(Element, NameSpaceSymbTable, Map, OutputStream)},
      * whereas it takes into account that subtree-c14n is -- well -- subtree-based.
      * So if the element in question isRoot of c14n, it's parent is not in the
      * node set, as well as all other ancestors.

src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/c14n/implementations/NameSpaceSymbTable.java

@@ -348,7 +348,7 @@ void put(String key, NameSpaceSymbEntry value) {
     List<NameSpaceSymbEntry> entrySet() {
         List<NameSpaceSymbEntry> a = new ArrayList<>();
         for (int i = 0;i < entries.length;i++) {
-            if (entries[i] != null && !"".equals(entries[i].uri)) {
+            if (entries[i] != null && entries[i].uri.length() != 0) {
                 a.add(entries[i]);
             }
         }

src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/keys/keyresolver/KeyResolver.java

@@ -170,8 +170,8 @@ public static void register(String className) throws
             ClassNotFoundException, IllegalAccessException,
             InstantiationException, InvocationTargetException {
         JavaUtils.checkRegisterPermission();
-        KeyResolverSpi keyResolverSpi =
-            (KeyResolverSpi) JavaUtils.newInstanceWithEmptyConstructor(ClassLoaderUtils.loadClass(className, KeyResolver.class));
+        KeyResolverSpi keyResolverSpi = (KeyResolverSpi)
+            JavaUtils.newInstanceWithEmptyConstructor(ClassLoaderUtils.loadClass(className, KeyResolver.class));
         register(keyResolverSpi, false);
     }
 
@@ -193,8 +193,8 @@ public static void registerAtStart(String className) {
         KeyResolverSpi keyResolverSpi = null;
         Exception ex = null;
         try {
-            keyResolverSpi = (KeyResolverSpi) JavaUtils.newInstanceWithEmptyConstructor(
-                    ClassLoaderUtils.loadClass(className, KeyResolver.class));
+            keyResolverSpi = (KeyResolverSpi)
+                JavaUtils.newInstanceWithEmptyConstructor(ClassLoaderUtils.loadClass(className, KeyResolver.class));
             register(keyResolverSpi, true);
         } catch (ClassNotFoundException | IllegalAccessException | InstantiationException | InvocationTargetException e) {
             ex = e;
@@ -253,8 +253,8 @@ public static void registerClassNames(List<String> classNames)
         JavaUtils.checkRegisterPermission();
         List<KeyResolverSpi> keyResolverList = new ArrayList<>(classNames.size());
         for (String className : classNames) {
-            KeyResolverSpi keyResolverSpi = (KeyResolverSpi)JavaUtils
-                    .newInstanceWithEmptyConstructor(ClassLoaderUtils.loadClass(className, KeyResolver.class));
+            KeyResolverSpi keyResolverSpi = (KeyResolverSpi)
+                JavaUtils.newInstanceWithEmptyConstructor(ClassLoaderUtils.loadClass(className, KeyResolver.class));
             keyResolverList.add(keyResolverSpi);
         }
         resolverList.addAll(keyResolverList);

src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/keys/keyresolver/implementations/KeyInfoReferenceResolver.java

@@ -162,6 +162,7 @@ private KeyInfo resolveReferentKeyInfo(Element element, String baseURI,
         validateReference(referentElement, secureValidation);
 
         KeyInfo referent = new KeyInfo(referentElement, baseURI);
+        referent.setSecureValidation(secureValidation);
         referent.addStorageResolver(storage);
         return referent;
     }
@@ -181,7 +182,7 @@ private void validateReference(Element referentElement, boolean secureValidation
         }
 
         KeyInfo referent = new KeyInfo(referentElement, "");
-        if (referent.containsKeyInfoReference()) {
+        if (referent.containsKeyInfoReference() || referent.containsRetrievalMethod()) {
             if (secureValidation) {
                 throw new XMLSecurityException("KeyInfoReferenceResolver.InvalidReferentElement.ReferenceWithSecure");
             } else {

src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/resource/config.xml

@@ -96,8 +96,6 @@
       <SignatureAlgorithm URI="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"
                           JAVACLASS="com.sun.org.apache.xml.internal.security.algorithms.implementations.SignatureBaseRSA$SignatureRSASHA512" />
 
-      <SignatureAlgorithm URI="http://www.w3.org/2007/05/xmldsig-more#ripemd160-rsa-MGF1"
-                          JAVACLASS="com.sun.org.apache.xml.internal.security.algorithms.implementations.SignatureBaseRSA$SignatureRSARIPEMD160MGF1" />
       <SignatureAlgorithm URI="http://www.w3.org/2007/05/xmldsig-more#sha1-rsa-MGF1"
                           JAVACLASS="com.sun.org.apache.xml.internal.security.algorithms.implementations.SignatureBaseRSA$SignatureRSASHA1MGF1" />
       <SignatureAlgorithm URI="http://www.w3.org/2007/05/xmldsig-more#sha224-rsa-MGF1"

src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/resource/xmlsecurity_en.properties

@@ -126,6 +126,7 @@ signature.Transform.ForbiddenTransform = Transform {0} is forbidden when secure
 signature.Transform.NotYetImplemented = Transform {0} not yet implemented
 signature.Transform.NullPointerTransform = Null pointer as URI. Programming bug?
 signature.Transform.UnknownTransform = Unknown transformation. No handler installed for URI {0}
+signature.Transform.XPathError = Error evaluating XPath expression
 signature.Transform.node = Current Node: {0}
 signature.Transform.nodeAndType = Current Node: {0}, type: {1} 
 signature.Util.BignumNonPositive = bigInteger.signum() must be positive
@@ -196,4 +197,4 @@ stax.signature.keyNameMissing = KeyName not configured.
 stax.keyNotFoundForName = No key configured for KeyName: {0}
 stax.keyTypeNotSupported = Key of type {0} not supported for a KeyName lookup
 stax.idsetbutnotgenerated = An Id attribute is specified, but Id generation is disabled
-stax.idgenerationdisablewithmultipleparts = Id generation must not be disabled when multiple parts need signing
+stax.idgenerationdisablewithmultipleparts = Id generation must not be disabled when multiple parts need signing

src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/signature/XMLSignatureInput.java

@@ -36,7 +36,6 @@
 import com.sun.org.apache.xml.internal.security.c14n.implementations.Canonicalizer11_OmitComments;
 import com.sun.org.apache.xml.internal.security.c14n.implementations.Canonicalizer20010315OmitComments;
 import com.sun.org.apache.xml.internal.security.c14n.implementations.CanonicalizerBase;
-import com.sun.org.apache.xml.internal.security.exceptions.XMLSecurityRuntimeException;
 import com.sun.org.apache.xml.internal.security.parser.XMLParserException;
 import com.sun.org.apache.xml.internal.security.utils.JavaUtils;
 import com.sun.org.apache.xml.internal.security.utils.XMLUtils;
@@ -141,7 +140,7 @@ public XMLSignatureInput(InputStream inputOctetStream)  {
 
     /**
      * Construct a XMLSignatureInput from a subtree rooted by rootNode. This
-     * method included the node and <I>all</I> his descendants in the output.
+     * method included the node and <I>all</I> its descendants in the output.
      *
      * @param rootNode
      */
@@ -528,7 +527,7 @@ private byte[] getBytesFromInputStream() throws IOException {
         if (inputOctetStreamProxy == null) {
             return null;
         }
-        try {
+        try {   //NOPMD
             bytes = JavaUtils.getBytesFromStream(inputOctetStreamProxy);
         } finally {
             inputOctetStreamProxy.close();
@@ -539,15 +538,9 @@ private byte[] getBytesFromInputStream() throws IOException {
     /**
      * @param filter
      */
-    public void addNodeFilter(NodeFilter filter) {
+    public void addNodeFilter(NodeFilter filter)  throws XMLParserException, IOException {
         if (isOctetStream()) {
-            try {
-                convertToNodes();
-            } catch (Exception e) {
-                throw new XMLSecurityRuntimeException(
-                    "signature.XMLSignatureInput.nodesetReference", e
-                );
-            }
+            convertToNodes();
         }
         nodeFilters.add(filter);
     }