Skip to content

Commit a6427c8

Browse files
seanjmullanseanjmullan
committedMar 4, 2021
8259709: Disable SHA-1 XML Signatures
Reviewed-by: rhalade, weijun
·
JEP-429-branchpoint
1 parent ef5e13d commit a6427c8

File tree

5 files changed

+54
-5
lines changed

5 files changed

+54
-5
lines changed
 

‎src/java.base/share/conf/security/java.security

+5
Original file line numberDiff line numberDiff line change
@@ -964,6 +964,11 @@ jdk.xml.dsig.secureValidationPolicy=\
964964
disallowAlg http://www.w3.org/2001/04/xmldsig-more#rsa-md5,\
965965
disallowAlg http://www.w3.org/2001/04/xmldsig-more#hmac-md5,\
966966
disallowAlg http://www.w3.org/2001/04/xmldsig-more#md5,\
967+
disallowAlg http://www.w3.org/2000/09/xmldsig#sha1,\
968+
disallowAlg http://www.w3.org/2000/09/xmldsig#dsa-sha1,\
969+
disallowAlg http://www.w3.org/2000/09/xmldsig#rsa-sha1,\
970+
disallowAlg http://www.w3.org/2007/05/xmldsig-more#sha1-rsa-MGF1,\
971+
disallowAlg http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1,\
967972
maxTransforms 5,\
968973
maxReferences 30,\
969974
disallowReferenceUriSchemes file http https,\

‎test/jdk/javax/xml/crypto/dsig/GenerationTests.java

+6
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
* java.base/sun.security.x509
3131
* java.xml.crypto/org.jcp.xml.dsig.internal.dom
3232
* jdk.httpserver/com.sun.net.httpserver
33+
* @library /test/lib
3334
* @compile -XDignore.symbol.file KeySelectors.java SignatureValidator.java
3435
* X509KeySelector.java GenerationTests.java
3536
* @run main/othervm/timeout=300 -Dsun.net.httpserver.nodelay=true GenerationTests
@@ -91,6 +92,8 @@
9192
import javax.xml.transform.stream.StreamResult;
9293
import org.w3c.dom.*;
9394

95+
import jdk.test.lib.security.SecurityUtils;
96+
9497
/**
9598
* Test that recreates merlin-xmldsig-twenty-three test vectors (and more)
9699
* but with different keys and X.509 data.
@@ -284,6 +287,9 @@ private static enum KeyInfoType {
284287
private static boolean result = true;
285288

286289
public static void main(String args[]) throws Exception {
290+
// Re-enable sha1 algs
291+
SecurityUtils.removeAlgsFromDSigPolicy("sha1");
292+
287293
setup();
288294
test_create_signature_enveloped_dsa(1024);
289295
test_create_signature_enveloped_dsa(2048);

‎test/jdk/javax/xml/crypto/dsig/SecureValidationPolicy.java

+8-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2016, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -23,7 +23,7 @@
2323

2424
/**
2525
* @test
26-
* @bug 8151893
26+
* @bug 8151893 8259709
2727
* @summary Tests for the jdk.xml.dsig.secureValidationPolicy security property
2828
* @modules java.xml.crypto/org.jcp.xml.dsig.internal.dom
2929
*/
@@ -42,7 +42,12 @@ public static void main(String[] args) throws Exception {
4242
"http://www.w3.org/TR/1999/REC-xslt-19991116",
4343
"http://www.w3.org/2001/04/xmldsig-more#rsa-md5",
4444
"http://www.w3.org/2001/04/xmldsig-more#hmac-md5",
45-
"http://www.w3.org/2001/04/xmldsig-more#md5");
45+
"http://www.w3.org/2001/04/xmldsig-more#md5",
46+
"http://www.w3.org/2000/09/xmldsig#sha1",
47+
"http://www.w3.org/2000/09/xmldsig#dsa-sha1",
48+
"http://www.w3.org/2000/09/xmldsig#rsa-sha1",
49+
"http://www.w3.org/2007/05/xmldsig-more#sha1-rsa-MGF1",
50+
"http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1");
4651

4752
// Test expected defaults
4853
System.out.println("Testing defaults");

‎test/jdk/javax/xml/crypto/dsig/ValidationTests.java

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2005, 2015, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2005, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -28,6 +28,7 @@
2828
* @modules java.base/sun.security.util
2929
* java.base/sun.security.x509
3030
* java.xml.crypto/org.jcp.xml.dsig.internal.dom
31+
* @library /test/lib
3132
* @compile -XDignore.symbol.file KeySelectors.java SignatureValidator.java
3233
* X509KeySelector.java ValidationTests.java
3334
* @run main/othervm ValidationTests
@@ -47,6 +48,8 @@
4748
import javax.xml.crypto.dsig.XMLSignatureException;
4849
import javax.xml.crypto.dsig.XMLSignatureFactory;
4950

51+
import jdk.test.lib.security.SecurityUtils;
52+
5053
public class ValidationTests {
5154

5255
private static SignatureValidator validator;
@@ -138,6 +141,9 @@ static class Test {
138141
};
139142

140143
public static void main(String args[]) throws Exception {
144+
// Re-enable sha1 algs
145+
SecurityUtils.removeAlgsFromDSigPolicy("sha1");
146+
141147
httpUd = new HttpURIDereferencer();
142148

143149
validator = new SignatureValidator(new File(DATA_DIR));

‎test/lib/jdk/test/lib/security/SecurityUtils.java

+28-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -70,5 +70,32 @@ private static void removeFromDisabledAlgs(String prop, List<String> algs) {
7070
Security.setProperty(prop, value);
7171
}
7272

73+
/**
74+
* Removes the specified algorithms from the
75+
* jdk.xml.dsig.secureValidationPolicy security property. Matches any
76+
* part of the algorithm URI.
77+
*/
78+
public static void removeAlgsFromDSigPolicy(String... algs) {
79+
removeFromDSigPolicy("disallowAlg", List.<String>of(algs));
80+
}
81+
82+
private static void removeFromDSigPolicy(String rule, List<String> algs) {
83+
String value = Security.getProperty("jdk.xml.dsig.secureValidationPolicy");
84+
value = Arrays.stream(value.split(","))
85+
.filter(v -> !v.contains(rule) ||
86+
!anyMatch(v, algs))
87+
.collect(Collectors.joining(","));
88+
Security.setProperty("jdk.xml.dsig.secureValidationPolicy", value);
89+
}
90+
91+
private static boolean anyMatch(String value, List<String> algs) {
92+
for (String alg : algs) {
93+
if (value.contains(alg)) {
94+
return true;
95+
}
96+
}
97+
return false;
98+
}
99+
73100
private SecurityUtils() {}
74101
}

0 commit comments

Comments
 (0)
Please sign in to comment.