Skip to content

Commit f133108

Browse files
committed
8305972: Update XML Security for Java to 3.0.2
Reviewed-by: mbaesken Backport-of: f0aebc8141de5a50c88658a40caa01967a9afc53
1 parent af1e82c commit f133108

39 files changed

+1281
-252
lines changed

src/java.base/share/conf/security/java.security

+17
Original file line numberDiff line numberDiff line change
@@ -983,6 +983,23 @@ jdk.xml.dsig.secureValidationPolicy=\
983983
noDuplicateIds,\
984984
noRetrievalMethodLoops
985985

986+
#
987+
# Support for the here() function
988+
#
989+
# This security property determines whether the here() XPath function is
990+
# supported in XML Signature generation and verification.
991+
#
992+
# If this property is set to false, the here() function is not supported.
993+
# Generating an XML Signature that uses the here() function will throw an
994+
# XMLSignatureException. Validating an existing XML Signature that uses the
995+
# here() function will also throw an XMLSignatureException.
996+
#
997+
# The default value for this property is true.
998+
#
999+
# Note: This property is currently used by the JDK Reference implementation.
1000+
# It is not guaranteed to be examined and used by other implementations.
1001+
#
1002+
#jdk.xml.dsig.hereFunctionSupported=true
9861003

9871004
#
9881005
# Deserialization JVM-wide filter factory

src/java.base/share/lib/security/default.policy

+2
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,8 @@ grant codeBase "jrt:/java.xml.crypto" {
9191
"removeProviderProperty.XMLDSig";
9292
permission java.security.SecurityPermission
9393
"com.sun.org.apache.xml.internal.security.register";
94+
permission java.security.SecurityPermission
95+
"getProperty.jdk.xml.dsig.hereFunctionSupported";
9496
permission java.security.SecurityPermission
9597
"getProperty.jdk.xml.dsig.secureValidationPolicy";
9698
permission java.lang.RuntimePermission

src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/algorithms/JCEMapper.java

+8
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,14 @@ public static void registerDefaultAlgorithms() {
209209
XMLSignature.ALGO_ID_SIGNATURE_ECDSA_RIPEMD160,
210210
new Algorithm("EC", "RIPEMD160withECDSA", "Signature")
211211
);
212+
algorithmsMap.put(
213+
XMLSignature.ALGO_ID_SIGNATURE_EDDSA_ED25519,
214+
new Algorithm("Ed25519", "Ed25519", "Signature")
215+
);
216+
algorithmsMap.put(
217+
XMLSignature.ALGO_ID_SIGNATURE_EDDSA_ED448,
218+
new Algorithm("Ed448", "Ed448", "Signature")
219+
);
212220
algorithmsMap.put(
213221
XMLSignature.ALGO_ID_MAC_HMAC_NOT_RECOMMENDED_MD5,
214222
new Algorithm("", "HmacMD5", "Mac", 0, 0)

src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/algorithms/SignatureAlgorithm.java

+7-4
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,7 @@
3131
import java.util.Map;
3232
import java.util.concurrent.ConcurrentHashMap;
3333

34-
import com.sun.org.apache.xml.internal.security.algorithms.implementations.IntegrityHmac;
35-
import com.sun.org.apache.xml.internal.security.algorithms.implementations.SignatureBaseRSA;
36-
import com.sun.org.apache.xml.internal.security.algorithms.implementations.SignatureDSA;
37-
import com.sun.org.apache.xml.internal.security.algorithms.implementations.SignatureECDSA;
34+
import com.sun.org.apache.xml.internal.security.algorithms.implementations.*;
3835
import com.sun.org.apache.xml.internal.security.exceptions.AlgorithmAlreadyRegisteredException;
3936
import com.sun.org.apache.xml.internal.security.exceptions.XMLSecurityException;
4037
import com.sun.org.apache.xml.internal.security.signature.XMLSignature;
@@ -496,6 +493,12 @@ public static void registerDefaultAlgorithms() {
496493
algorithmHash.put(
497494
XMLSignature.ALGO_ID_SIGNATURE_ECDSA_RIPEMD160, SignatureECDSA.SignatureECDSARIPEMD160.class
498495
);
496+
algorithmHash.put(
497+
XMLSignature.ALGO_ID_SIGNATURE_EDDSA_ED25519, SignatureEDDSA.SignatureEd25519.class
498+
);
499+
algorithmHash.put(
500+
XMLSignature.ALGO_ID_SIGNATURE_EDDSA_ED448, SignatureEDDSA.SignatureEd448.class
501+
);
499502
algorithmHash.put(
500503
XMLSignature.ALGO_ID_MAC_HMAC_NOT_RECOMMENDED_MD5, IntegrityHmac.IntegrityHmacMD5.class
501504
);

src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/algorithms/implementations/ECDSAUtils.java

+2-7
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@
3030
import java.security.interfaces.ECPublicKey;
3131
import java.security.spec.*;
3232
import java.util.ArrayList;
33-
import java.util.Iterator;
3433
import java.util.List;
3534

3635
public final class ECDSAUtils {
@@ -786,9 +785,7 @@ public static String getOIDFromPublicKey(ECPublicKey ecPublicKey) {
786785
field = ecFieldF2m.getReductionPolynomial();
787786
}
788787

789-
Iterator<ECCurveDefinition> ecCurveDefinitionIterator = ecCurveDefinitions.iterator();
790-
while (ecCurveDefinitionIterator.hasNext()) {
791-
ECCurveDefinition ecCurveDefinition = ecCurveDefinitionIterator.next();
788+
for (ECCurveDefinition ecCurveDefinition : ecCurveDefinitions) {
792789
String oid = ecCurveDefinition.equals(field, a, b, affineX, affineY, order, h);
793790
if (oid != null) {
794791
return oid;
@@ -798,9 +795,7 @@ public static String getOIDFromPublicKey(ECPublicKey ecPublicKey) {
798795
}
799796

800797
public static ECCurveDefinition getECCurveDefinition(String oid) {
801-
Iterator<ECCurveDefinition> ecCurveDefinitionIterator = ecCurveDefinitions.iterator();
802-
while (ecCurveDefinitionIterator.hasNext()) {
803-
ECCurveDefinition ecCurveDefinition = ecCurveDefinitionIterator.next();
798+
for (ECCurveDefinition ecCurveDefinition : ecCurveDefinitions) {
804799
if (ecCurveDefinition.getOid().equals(oid)) {
805800
return ecCurveDefinition;
806801
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,228 @@
1+
/*
2+
* reserved comment block
3+
* DO NOT REMOVE OR ALTER!
4+
*/
5+
/**
6+
* Licensed to the Apache Software Foundation (ASF) under one
7+
* or more contributor license agreements. See the NOTICE file
8+
* distributed with this work for additional information
9+
* regarding copyright ownership. The ASF licenses this file
10+
* to you under the Apache License, Version 2.0 (the
11+
* "License"); you may not use this file except in compliance
12+
* with the License. You may obtain a copy of the License at
13+
*
14+
* http://www.apache.org/licenses/LICENSE-2.0
15+
*
16+
* Unless required by applicable law or agreed to in writing,
17+
* software distributed under the License is distributed on an
18+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
19+
* KIND, either express or implied. See the License for the
20+
* specific language governing permissions and limitations
21+
* under the License.
22+
*/
23+
package com.sun.org.apache.xml.internal.security.algorithms.implementations;
24+
25+
import com.sun.org.apache.xml.internal.security.algorithms.JCEMapper;
26+
import com.sun.org.apache.xml.internal.security.algorithms.SignatureAlgorithmSpi;
27+
import com.sun.org.apache.xml.internal.security.signature.XMLSignature;
28+
import com.sun.org.apache.xml.internal.security.signature.XMLSignatureException;
29+
import com.sun.org.apache.xml.internal.security.utils.XMLUtils;
30+
31+
import java.io.IOException;
32+
import java.security.*;
33+
import java.security.spec.AlgorithmParameterSpec;
34+
35+
/**
36+
*
37+
*/
38+
public abstract class SignatureEDDSA extends SignatureAlgorithmSpi {
39+
40+
private static final com.sun.org.slf4j.internal.Logger LOG =
41+
com.sun.org.slf4j.internal.LoggerFactory.getLogger(SignatureEDDSA.class);
42+
43+
private final Signature signatureAlgorithm;
44+
45+
46+
/**
47+
* Constructor SignatureEDDSA
48+
*
49+
* @throws XMLSignatureException
50+
*/
51+
public SignatureEDDSA() throws XMLSignatureException {
52+
this(null);
53+
}
54+
55+
public SignatureEDDSA(Provider provider) throws XMLSignatureException {
56+
String algorithmID = JCEMapper.translateURItoJCEID(this.engineGetURI());
57+
LOG.debug("Created SignatureEDDSA using {}", algorithmID);
58+
59+
try {
60+
if (provider == null) {
61+
String providerId = JCEMapper.getProviderId();
62+
if (providerId == null) {
63+
this.signatureAlgorithm = Signature.getInstance(algorithmID);
64+
65+
} else {
66+
this.signatureAlgorithm = Signature.getInstance(algorithmID, providerId);
67+
}
68+
69+
} else {
70+
this.signatureAlgorithm = Signature.getInstance(algorithmID, provider);
71+
}
72+
73+
} catch (NoSuchAlgorithmException | NoSuchProviderException ex) {
74+
Object[] exArgs = { algorithmID, ex.getLocalizedMessage() };
75+
throw new XMLSignatureException("algorithms.NoSuchAlgorithm", exArgs);
76+
}
77+
}
78+
79+
/** {@inheritDoc} */
80+
protected void engineSetParameter(AlgorithmParameterSpec params)
81+
throws XMLSignatureException {
82+
try {
83+
this.signatureAlgorithm.setParameter(params);
84+
} catch (InvalidAlgorithmParameterException ex) {
85+
throw new XMLSignatureException(ex);
86+
}
87+
}
88+
89+
/** {@inheritDoc} */
90+
protected boolean engineVerify(byte[] signature) throws XMLSignatureException {
91+
try {
92+
93+
if (LOG.isDebugEnabled()) {
94+
LOG.debug("Called SignatureEDDSA.verify() on " + XMLUtils.encodeToString(signature));
95+
}
96+
97+
return this.signatureAlgorithm.verify(signature);
98+
} catch (SignatureException ex) {
99+
throw new XMLSignatureException(ex);
100+
}
101+
}
102+
103+
/** {@inheritDoc} */
104+
protected void engineInitVerify(Key publicKey) throws XMLSignatureException {
105+
engineInitVerify(publicKey, signatureAlgorithm);
106+
}
107+
108+
/** {@inheritDoc} */
109+
protected byte[] engineSign() throws XMLSignatureException {
110+
try {
111+
return this.signatureAlgorithm.sign();
112+
} catch (SignatureException ex) {
113+
throw new XMLSignatureException(ex);
114+
}
115+
}
116+
117+
/** {@inheritDoc} */
118+
protected void engineInitSign(Key privateKey, SecureRandom secureRandom)
119+
throws XMLSignatureException {
120+
121+
engineInitSign(privateKey, secureRandom, this.signatureAlgorithm);
122+
}
123+
124+
/** {@inheritDoc} */
125+
protected void engineInitSign(Key privateKey) throws XMLSignatureException {
126+
engineInitSign(privateKey, (SecureRandom)null);
127+
}
128+
129+
/** {@inheritDoc} */
130+
protected void engineUpdate(byte[] input) throws XMLSignatureException {
131+
try {
132+
this.signatureAlgorithm.update(input);
133+
} catch (SignatureException ex) {
134+
throw new XMLSignatureException(ex);
135+
}
136+
}
137+
138+
/** {@inheritDoc} */
139+
protected void engineUpdate(byte input) throws XMLSignatureException {
140+
try {
141+
this.signatureAlgorithm.update(input);
142+
} catch (SignatureException ex) {
143+
throw new XMLSignatureException(ex);
144+
}
145+
}
146+
147+
/** {@inheritDoc} */
148+
protected void engineUpdate(byte[] buf, int offset, int len) throws XMLSignatureException {
149+
try {
150+
this.signatureAlgorithm.update(buf, offset, len);
151+
} catch (SignatureException ex) {
152+
throw new XMLSignatureException(ex);
153+
}
154+
}
155+
156+
/** {@inheritDoc} */
157+
protected String engineGetJCEAlgorithmString() {
158+
return this.signatureAlgorithm.getAlgorithm();
159+
}
160+
161+
/** {@inheritDoc} */
162+
protected String engineGetJCEProviderName() {
163+
return this.signatureAlgorithm.getProvider().getName();
164+
}
165+
166+
/** {@inheritDoc} */
167+
protected void engineSetHMACOutputLength(int HMACOutputLength)
168+
throws XMLSignatureException {
169+
throw new XMLSignatureException("algorithms.HMACOutputLengthOnlyForHMAC");
170+
}
171+
172+
/** {@inheritDoc} */
173+
protected void engineInitSign(
174+
Key signingKey, AlgorithmParameterSpec algorithmParameterSpec
175+
) throws XMLSignatureException {
176+
throw new XMLSignatureException("algorithms.CannotUseAlgorithmParameterSpecOnEdDSA");
177+
}
178+
179+
/**
180+
* Class SignatureEd25519
181+
*
182+
*/
183+
public static class SignatureEd25519 extends SignatureEDDSA {
184+
/**
185+
* Constructor SignatureEd25519
186+
*
187+
* @throws XMLSignatureException
188+
*/
189+
public SignatureEd25519() throws XMLSignatureException {
190+
super();
191+
}
192+
193+
public SignatureEd25519(Provider provider) throws XMLSignatureException {
194+
super(provider);
195+
}
196+
197+
/** {@inheritDoc} */
198+
@Override
199+
public String engineGetURI() {
200+
return XMLSignature.ALGO_ID_SIGNATURE_EDDSA_ED25519;
201+
}
202+
}
203+
204+
/**
205+
* Class SignatureEd448
206+
*/
207+
public static class SignatureEd448 extends SignatureEDDSA {
208+
209+
/**
210+
* Constructor SignatureEd448
211+
*
212+
* @throws XMLSignatureException
213+
*/
214+
public SignatureEd448() throws XMLSignatureException {
215+
super();
216+
}
217+
218+
public SignatureEd448(Provider provider) throws XMLSignatureException {
219+
super(provider);
220+
}
221+
222+
/** {@inheritDoc} */
223+
@Override
224+
public String engineGetURI() {
225+
return XMLSignature.ALGO_ID_SIGNATURE_EDDSA_ED448;
226+
}
227+
}
228+
}

0 commit comments

Comments
 (0)