com.sun.org.apache.xml.internal.security.exceptions.XMLSecurityException Java Examples

/**
 * Resolves the input from the given retrieval method
 * @return
 * @throws XMLSecurityException
 */
private static XMLSignatureInput resolveInput(
    RetrievalMethod rm, String baseURI, boolean secureValidation
) throws XMLSecurityException {
    Attr uri = rm.getURIAttr();
    // Apply the transforms
    Transforms transforms = rm.getTransforms();
    ResourceResolver resRes = ResourceResolver.getInstance(uri, baseURI, secureValidation);
    XMLSignatureInput resource = resRes.resolve(uri, baseURI, secureValidation);
    if (transforms != null) {
        if (log.isLoggable(java.util.logging.Level.FINE)) {
            log.log(java.util.logging.Level.FINE, "We have Transforms");
        }
        resource = transforms.performTransforms(resource);
    }
    return resource;
}
 

public String getInclusiveNamespaces() {
    String c14nMethodURI = c14nMethod.getAttributeNS(null, Constants._ATT_ALGORITHM);
    if (!(c14nMethodURI.equals("http://www.w3.org/2001/10/xml-exc-c14n#") ||
        c14nMethodURI.equals("http://www.w3.org/2001/10/xml-exc-c14n#WithComments"))) {
        return null;
    }

    Element inclusiveElement = XMLUtils.getNextElement(c14nMethod.getFirstChild());

    if (inclusiveElement != null) {
        try {
            String inclusiveNamespaces =
                new InclusiveNamespaces(
                    inclusiveElement,
                    InclusiveNamespaces.ExclusiveCanonicalizationNamespace
                ).getInclusiveNamespaces();
            return inclusiveNamespaces;
        } catch (XMLSecurityException e) {
            return null;
        }
    }
    return null;
}
 

/** {@inheritDoc}. */
public PublicKey engineLookupAndResolvePublicKey(Element element, String baseURI, StorageResolver storage)
    throws KeyResolverException {

    if (log.isLoggable(java.util.logging.Level.FINE)) {
        log.log(java.util.logging.Level.FINE, "Can I resolve " + element.getTagName());
    }

    if (!engineCanResolve(element, baseURI, storage)) {
        return null;
    }

    try {
        KeyInfo referent = resolveReferentKeyInfo(element, baseURI, storage);
        if (referent != null) {
            return referent.getPublicKey();
        }
    } catch (XMLSecurityException e) {
        if (log.isLoggable(java.util.logging.Level.FINE)) {
            log.log(java.util.logging.Level.FINE, "XMLSecurityException", e);
        }
    }

    return null;
}
 

/**
 * After verifying a {@link Manifest} or a {@link SignedInfo} using the
 * {@link Manifest#verifyReferences()} or {@link SignedInfo#verify()} methods,
 * the individual results can be retrieved with this method.
 *
 * @param index an index of into a {@link Manifest} or a {@link SignedInfo}
 * @return the results of reference validation at the specified index
 * @throws XMLSecurityException
 */
public boolean getVerificationResult(int index) throws XMLSecurityException {
    if ((index < 0) || (index > this.getLength() - 1)) {
        Object exArgs[] = { Integer.toString(index), Integer.toString(this.getLength()) };
        Exception e =
            new IndexOutOfBoundsException(
                I18n.translate("signature.Verification.IndexOutOfBounds", exArgs)
            );

        throw new XMLSecurityException("generic.EmptyMessage", e);
    }

    if (this.verificationResults == null) {
        try {
            this.verifyReferences();
        } catch (Exception ex) {
            throw new XMLSecurityException("generic.EmptyMessage", ex);
        }
    }

    return this.verificationResults[index];
}
 

/**
 * Constructs {@link SignatureProperties} from {@link Element}
 * @param element <code>SignatureProperties</code> element
 * @param BaseURI the URI of the resource where the XML instance was stored
 * @throws XMLSecurityException
 */
public SignatureProperties(Element element, String BaseURI) throws XMLSecurityException {
    super(element, BaseURI);

    Attr attr = element.getAttributeNodeNS(null, "Id");
    if (attr != null) {
        element.setIdAttributeNode(attr, true);
    }

    int length = getLength();
    for (int i = 0; i < length; i++) {
        Element propertyElem =
            XMLUtils.selectDsNode(this.constructionElement, Constants._TAG_SIGNATUREPROPERTY, i);
        Attr propertyAttr = propertyElem.getAttributeNodeNS(null, "Id");
        if (propertyAttr != null) {
            propertyElem.setIdAttributeNode(propertyAttr, true);
        }
    }
}
 

/**
 * Constructor X509Data
 *
 * @param element
 * @param baseURI
 * @throws XMLSecurityException
 */
public X509Data(Element element, String baseURI) throws XMLSecurityException {
    super(element, baseURI);

    Node sibling = this.constructionElement.getFirstChild();
    while (sibling != null) {
        if (sibling.getNodeType() != Node.ELEMENT_NODE) {
            sibling = sibling.getNextSibling();
            continue;
        }
        return;
    }
    /* No Elements found */
    Object exArgs[] = { "Elements", Constants._TAG_X509DATA };
    throw new XMLSecurityException("xml.WrongContent", exArgs);
}
 

/** {@inheritDoc}. */
public X509Certificate engineLookupResolveX509Certificate(Element element, String baseURI, StorageResolver storage)
    throws KeyResolverException {

    if (log.isLoggable(java.util.logging.Level.FINE)) {
        log.log(java.util.logging.Level.FINE, "Can I resolve " + element.getTagName());
    }

    if (!engineCanResolve(element, baseURI, storage)) {
        return null;
    }

    try {
        KeyInfo referent = resolveReferentKeyInfo(element, baseURI, storage);
        if (referent != null) {
            return referent.getX509Certificate();
        }
    } catch (XMLSecurityException e) {
        if (log.isLoggable(java.util.logging.Level.FINE)) {
            log.log(java.util.logging.Level.FINE, "XMLSecurityException", e);
        }
    }

    return null;
}
 

/**
 * Resolves the input from the given retrieval method
 * @return
 * @throws XMLSecurityException
 */
private static XMLSignatureInput resolveInput(
    RetrievalMethod rm, String baseURI, boolean secureValidation
) throws XMLSecurityException {
    Attr uri = rm.getURIAttr();
    // Apply the transforms
    Transforms transforms = rm.getTransforms();
    ResourceResolver resRes = ResourceResolver.getInstance(uri, baseURI, secureValidation);
    XMLSignatureInput resource = resRes.resolve(uri, baseURI, secureValidation);
    if (transforms != null) {
        if (log.isLoggable(java.util.logging.Level.FINE)) {
            log.log(java.util.logging.Level.FINE, "We have Transforms");
        }
        resource = transforms.performTransforms(resource);
    }
    return resource;
}
 

/**
 * Build a {@link Reference} from an {@link Element}
 *
 * @param element <code>Reference</code> element
 * @param baseURI the URI of the resource where the XML instance was stored
 * @param manifest is the {@link Manifest} of {@link SignedInfo} in which the Reference occurs.
 * @param secureValidation whether secure validation is enabled or not
 * We need this because the Manifest has the individual {@link ResourceResolver}s which have
 * been set by the user
 * @throws XMLSecurityException
 */
protected Reference(Element element, String baseURI, Manifest manifest, boolean secureValidation)
    throws XMLSecurityException {
    super(element, baseURI);
    this.secureValidation = secureValidation;
    this.baseURI = baseURI;
    Element el = XMLUtils.getNextElement(element.getFirstChild());
    if (Constants._TAG_TRANSFORMS.equals(el.getLocalName())
        && Constants.SignatureSpecNS.equals(el.getNamespaceURI())) {
        transforms = new Transforms(el, this.baseURI);
        transforms.setSecureValidation(secureValidation);
        if (secureValidation && transforms.getLength() > MAXIMUM_TRANSFORM_COUNT) {
            Object exArgs[] = { transforms.getLength(), MAXIMUM_TRANSFORM_COUNT };

            throw new XMLSecurityException("signature.tooManyTransforms", exArgs);
        }
        el = XMLUtils.getNextElement(el.getNextSibling());
    }
    digestMethodElem = el;
    digestValueElement = XMLUtils.getNextElement(digestMethodElem.getNextSibling());
    this.manifest = manifest;
}
 

public void guaranteeThatElementInCorrectSpace(
    ElementProxy expected, Element actual
) throws XMLSecurityException {

    String expectedLocalname = expected.getBaseLocalName();
    String expectedNamespace = expected.getBaseNamespace();

    String localnameIS = actual.getLocalName();
    String namespaceIS = actual.getNamespaceURI();
    if ((expectedNamespace != namespaceIS) ||
        !expectedLocalname.equals(localnameIS)) {
        Object exArgs[] = { namespaceIS + ":" + localnameIS,
                            expectedNamespace + ":" + expectedLocalname};
        throw new XMLSecurityException("xml.WrongElement", exArgs);
    }
}
 

/**
 * Method guaranteeThatElementInCorrectSpace
 *
 * @throws XMLSecurityException
 */
void guaranteeThatElementInCorrectSpace() throws XMLSecurityException {

    String expectedLocalName = this.getBaseLocalName();
    String expectedNamespaceUri = this.getBaseNamespace();

    String actualLocalName = this.constructionElement.getLocalName();
    String actualNamespaceUri = this.constructionElement.getNamespaceURI();

    if(!expectedNamespaceUri.equals(actualNamespaceUri)
        && !expectedLocalName.equals(actualLocalName)) {
        Object exArgs[] = { actualNamespaceUri + ":" + actualLocalName,
                            expectedNamespaceUri + ":" + expectedLocalName};
        throw new XMLSecurityException("xml.WrongElement", exArgs);
    }
}
 

/**
 * Method setDefaultPrefix
 *
 * @param namespace
 * @param prefix
 * @throws XMLSecurityException
 * @throws SecurityException if a security manager is installed and the
 *    caller does not have permission to set the default prefix
 */
public static void setDefaultPrefix(String namespace, String prefix)
    throws XMLSecurityException {
    JavaUtils.checkRegisterPermission();
    if (prefixMappings.containsValue(prefix)) {
        String storedPrefix = prefixMappings.get(namespace);
        if (!storedPrefix.equals(prefix)) {
            Object exArgs[] = { prefix, namespace, storedPrefix };

            throw new XMLSecurityException("prefix.AlreadyAssigned", exArgs);
        }
    }

    if (Constants.SignatureSpecNS.equals(namespace)) {
        XMLUtils.setDsPrefix(prefix);
    }
    if (EncryptionConstants.EncryptionSpecNS.equals(namespace)) {
        XMLUtils.setXencPrefix(prefix);
    }
    prefixMappings.put(namespace, prefix);
}
 

/**
 * Method guaranteeThatElementInCorrectSpace
 *
 * @throws XMLSecurityException
 */
void guaranteeThatElementInCorrectSpace() throws XMLSecurityException {

    String expectedLocalName = this.getBaseLocalName();
    String expectedNamespaceUri = this.getBaseNamespace();

    String actualLocalName = this.constructionElement.getLocalName();
    String actualNamespaceUri = this.constructionElement.getNamespaceURI();

    if(!expectedNamespaceUri.equals(actualNamespaceUri)
        && !expectedLocalName.equals(actualLocalName)) {
        Object exArgs[] = { actualNamespaceUri + ":" + actualLocalName,
                            expectedNamespaceUri + ":" + expectedLocalName};
        throw new XMLSecurityException("xml.WrongElement", exArgs);
    }
}
 

/**
 * Constructor X509Data
 *
 * @param element
 * @param baseURI
 * @throws XMLSecurityException
 */
public X509Data(Element element, String baseURI) throws XMLSecurityException {
    super(element, baseURI);

    Node sibling = this.constructionElement.getFirstChild();
    while (sibling != null) {
        if (sibling.getNodeType() != Node.ELEMENT_NODE) {
            sibling = sibling.getNextSibling();
            continue;
        }
        return;
    }
    /* No Elements found */
    Object exArgs[] = { "Elements", Constants._TAG_X509DATA };
    throw new XMLSecurityException("xml.WrongContent", exArgs);
}
 

/**
 * Method setDefaultPrefix
 *
 * @param namespace
 * @param prefix
 * @throws XMLSecurityException
 */
public static void setDefaultPrefix(String namespace, String prefix)
    throws XMLSecurityException {
    if (prefixMappings.containsValue(prefix)) {
        String storedPrefix = prefixMappings.get(namespace);
        if (!storedPrefix.equals(prefix)) {
            Object exArgs[] = { prefix, namespace, storedPrefix };

            throw new XMLSecurityException("prefix.AlreadyAssigned", exArgs);
        }
    }

    if (Constants.SignatureSpecNS.equals(namespace)) {
        XMLUtils.setDsPrefix(prefix);
    }
    if (EncryptionConstants.EncryptionSpecNS.equals(namespace)) {
        XMLUtils.setXencPrefix(prefix);
    }
    prefixMappings.put(namespace, prefix);
}
 

/**
 * Validate the Element referred to by the KeyInfoReference.
 *
 * @param referentElement
 *
 * @throws XMLSecurityException
 */
private void validateReference(Element referentElement) throws XMLSecurityException {
    if (!XMLUtils.elementIsInSignatureSpace(referentElement, Constants._TAG_KEYINFO)) {
        Object exArgs[] = { new QName(referentElement.getNamespaceURI(), referentElement.getLocalName()) };
        throw new XMLSecurityException("KeyInfoReferenceResolver.InvalidReferentElement.WrongType", exArgs);
    }

    KeyInfo referent = new KeyInfo(referentElement, "");
    if (referent.containsKeyInfoReference()) {
        if (secureValidation) {
            throw new XMLSecurityException("KeyInfoReferenceResolver.InvalidReferentElement.ReferenceWithSecure");
        } else {
            // Don't support chains of references at this time. If do support in the future, this is where the code
            // would go to validate that don't have a cycle, resulting in an infinite loop. This may be unrealistic
            // to implement, and/or very expensive given remote URI references.
            throw new XMLSecurityException("KeyInfoReferenceResolver.InvalidReferentElement.ReferenceWithoutSecure");
        }
    }

}
 

/**
 * Method itemRetrievalMethod
 *
 * @param i
 *@return the asked RetrievalMethod element, null if the index is too big
 * @throws XMLSecurityException
 */
public RetrievalMethod itemRetrievalMethod(int i) throws XMLSecurityException {
    Element e =
        XMLUtils.selectDsNode(
            this.constructionElement.getFirstChild(), Constants._TAG_RETRIEVALMETHOD, i);

    if (e != null) {
        return new RetrievalMethod(e, this.baseURI);
    }
    return null;
}
 

/**
 * Constructor SignatureAlgorithm
 *
 * @param doc
 * @param algorithmURI
 * @throws XMLSecurityException
 */
public SignatureAlgorithm(Document doc, String algorithmURI) throws XMLSecurityException {
    super(doc, algorithmURI);
    this.algorithmURI = algorithmURI;

    signatureAlgorithm = getSignatureAlgorithmSpi(algorithmURI);
    signatureAlgorithm.engineGetContextFromElement(this.constructionElement);
}
 

/**
 * Returns getCanonicalizedOctetStream
 *
 * @return the canonicalization result octet stream of <code>SignedInfo</code> element
 * @throws CanonicalizationException
 * @throws InvalidCanonicalizerException
 * @throws XMLSecurityException
 */
public byte[] getCanonicalizedOctetStream()
    throws CanonicalizationException, InvalidCanonicalizerException, XMLSecurityException {
    if (this.c14nizedBytes == null) {
        Canonicalizer c14nizer =
            Canonicalizer.getInstance(this.getCanonicalizationMethodURI());

        this.c14nizedBytes =
            c14nizer.canonicalizeSubtree(this.constructionElement);
    }

    // make defensive copy
    return this.c14nizedBytes.clone();
}
 

/**
 * Constructor KeyInfo
 *
 * @param element
 * @param baseURI
 * @throws XMLSecurityException
 */
public KeyInfo(Element element, String baseURI) throws XMLSecurityException {
    super(element, baseURI);

    Attr attr = element.getAttributeNodeNS(null, "Id");
    if (attr != null) {
        element.setIdAttributeNode(attr, true);
    }
}
 

/**
 * Method itemCertificate
 *
 * @param i
 * @return the X509Certifacte, null if not present
 * @throws XMLSecurityException
 */
public XMLX509Certificate itemCertificate(int i) throws XMLSecurityException {

    Element e =
        XMLUtils.selectDsNode(
            this.constructionElement.getFirstChild(), Constants._TAG_X509CERTIFICATE, i);

    if (e != null) {
        return new XMLX509Certificate(e, this.baseURI);
    }
    return null;
}
 

/**
 * This method registers the default prefixes.
 */
public static void registerDefaultPrefixes() throws XMLSecurityException {
    setDefaultPrefix("http://www.w3.org/2000/09/xmldsig#", "ds");
    setDefaultPrefix("http://www.w3.org/2001/04/xmlenc#", "xenc");
    setDefaultPrefix("http://www.w3.org/2009/xmlenc11#", "xenc11");
    setDefaultPrefix("http://www.xmlsecurity.org/experimental#", "experimental");
    setDefaultPrefix("http://www.w3.org/2002/04/xmldsig-filter2", "dsig-xpath-old");
    setDefaultPrefix("http://www.w3.org/2002/06/xmldsig-filter2", "dsig-xpath");
    setDefaultPrefix("http://www.w3.org/2001/10/xml-exc-c14n#", "ec");
    setDefaultPrefix(
        "http://www.nue.et-inf.uni-siegen.de/~geuer-pollmann/#xpathFilter", "xx"
    );
}
 

private PrivateKey resolveX509Certificate(
    XMLX509Certificate x509Cert
) throws XMLSecurityException, KeyStoreException {
    log.log(java.util.logging.Level.FINE, "Can I resolve X509Certificate?");
    byte[] x509CertBytes = x509Cert.getCertificateBytes();

    Enumeration<String> aliases = keyStore.aliases();
    while (aliases.hasMoreElements()) {
        String alias = aliases.nextElement();
        if (keyStore.isKeyEntry(alias)) {

            Certificate cert = keyStore.getCertificate(alias);
            if (cert instanceof X509Certificate) {
                byte[] certBytes = null;

                try {
                    certBytes = cert.getEncoded();
                } catch (CertificateEncodingException e1) {
                }

                if (certBytes != null && Arrays.equals(certBytes, x509CertBytes)) {
                    log.log(java.util.logging.Level.FINE, "match !!! ");

                    try {
                        Key key = keyStore.getKey(alias, password);
                        if (key instanceof PrivateKey) {
                            return (PrivateKey) key;
                        }
                    }
                    catch (Exception e) {
                        log.log(java.util.logging.Level.FINE, "Cannot recover the key", e);
                        // Keep searching
                    }
                }
            }
        }
    }

    return null;
}
 

private PrivateKey resolveX509Certificate(
    XMLX509Certificate x509Cert
) throws XMLSecurityException, KeyStoreException {
    log.log(java.util.logging.Level.FINE, "Can I resolve X509Certificate?");
    byte[] x509CertBytes = x509Cert.getCertificateBytes();

    Enumeration<String> aliases = keyStore.aliases();
    while (aliases.hasMoreElements()) {
        String alias = aliases.nextElement();
        if (keyStore.isKeyEntry(alias)) {

            Certificate cert = keyStore.getCertificate(alias);
            if (cert instanceof X509Certificate) {
                byte[] certBytes = null;

                try {
                    certBytes = cert.getEncoded();
                } catch (CertificateEncodingException e1) {
                }

                if (certBytes != null && Arrays.equals(certBytes, x509CertBytes)) {
                    log.log(java.util.logging.Level.FINE, "match !!! ");

                    try {
                        Key key = keyStore.getKey(alias, password);
                        if (key instanceof PrivateKey) {
                            return (PrivateKey) key;
                        }
                    }
                    catch (Exception e) {
                        log.log(java.util.logging.Level.FINE, "Cannot recover the key", e);
                        // Keep searching
                    }
                }
            }
        }
    }

    return null;
}
 

protected XMLSignatureInput enginePerformTransform(
    XMLSignatureInput input, OutputStream os, Transform transformObject
) throws CanonicalizationException {
    try {
        String inclusiveNamespaces = null;

        if (transformObject.length(
            InclusiveNamespaces.ExclusiveCanonicalizationNamespace,
            InclusiveNamespaces._TAG_EC_INCLUSIVENAMESPACES) == 1
        ) {
            Element inclusiveElement =
                XMLUtils.selectNode(
                    transformObject.getElement().getFirstChild(),
                    InclusiveNamespaces.ExclusiveCanonicalizationNamespace,
                    InclusiveNamespaces._TAG_EC_INCLUSIVENAMESPACES,
                    0
                );

            inclusiveNamespaces =
                new InclusiveNamespaces(
                    inclusiveElement, transformObject.getBaseURI()
                ).getInclusiveNamespaces();
        }

        Canonicalizer20010315ExclWithComments c14n =
            new Canonicalizer20010315ExclWithComments();
        if (os != null) {
            c14n.setWriter(os);
        }
        byte[] result = c14n.engineCanonicalize(input, inclusiveNamespaces);
        XMLSignatureInput output = new XMLSignatureInput(result);

        return output;
    } catch (XMLSecurityException ex) {
        throw new CanonicalizationException("empty", ex);
    }
}
 

/**
 * This method registers the default prefixes.
 */
public static void registerDefaultPrefixes() throws XMLSecurityException {
    setDefaultPrefix("http://www.w3.org/2000/09/xmldsig#", "ds");
    setDefaultPrefix("http://www.w3.org/2001/04/xmlenc#", "xenc");
    setDefaultPrefix("http://www.w3.org/2009/xmlenc11#", "xenc11");
    setDefaultPrefix("http://www.xmlsecurity.org/experimental#", "experimental");
    setDefaultPrefix("http://www.w3.org/2002/04/xmldsig-filter2", "dsig-xpath-old");
    setDefaultPrefix("http://www.w3.org/2002/06/xmldsig-filter2", "dsig-xpath");
    setDefaultPrefix("http://www.w3.org/2001/10/xml-exc-c14n#", "ec");
    setDefaultPrefix(
        "http://www.nue.et-inf.uni-siegen.de/~geuer-pollmann/#xpathFilter", "xx"
    );
}
 

/**
 * Method itemDigest
 *
 * @param i
 * @return the X509Digest, null if not present
 * @throws XMLSecurityException
 */
public XMLX509Digest itemDigest(int i) throws XMLSecurityException {

    Element e =
        XMLUtils.selectDs11Node(
            this.constructionElement.getFirstChild(), Constants._TAG_X509DIGEST, i);

    if (e != null) {
        return new XMLX509Digest(e, this.baseURI);
    }
    return null;
}
 

/**
 * Method itemRetrievalMethod
 *
 * @param i
 *@return the asked RetrievalMethod element, null if the index is too big
 * @throws XMLSecurityException
 */
public RetrievalMethod itemRetrievalMethod(int i) throws XMLSecurityException {
    Element e =
        XMLUtils.selectDsNode(
            this.constructionElement.getFirstChild(), Constants._TAG_RETRIEVALMETHOD, i);

    if (e != null) {
        return new RetrievalMethod(e, this.baseURI);
    }
    return null;
}
 

/**
 * Returns the digest value.
 *
 * @return the digest value.
 * @throws Base64DecodingException if Reference contains no proper base64 encoded data.
 * @throws XMLSecurityException if the Reference does not contain a DigestValue element
 */
public byte[] getDigestValue() throws Base64DecodingException, XMLSecurityException {
    if (digestValueElement == null) {
        // The required element is not in the XML!
        Object[] exArgs ={ Constants._TAG_DIGESTVALUE, Constants.SignatureSpecNS };
        throw new XMLSecurityException(
            "signature.Verification.NoSignatureElement", exArgs
        );
    }
    return Base64.decode(digestValueElement);
}
 

/**
 * Method itemIssuerSerial
 *
 * @param i
 * @return the X509IssuerSerial, null if not present
 * @throws XMLSecurityException
 */
public XMLX509IssuerSerial itemIssuerSerial(int i) throws XMLSecurityException {
    Element e =
        XMLUtils.selectDsNode(
            this.constructionElement.getFirstChild(), Constants._TAG_X509ISSUERSERIAL, i);

    if (e != null) {
        return new XMLX509IssuerSerial(e, this.baseURI);
    }
    return null;
}