0N/A/*
2362N/A * Copyright (c) 2005, 2006, Oracle and/or its affiliates. All rights reserved.
0N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
0N/A *
0N/A * This code is free software; you can redistribute it and/or modify it
0N/A * under the terms of the GNU General Public License version 2 only, as
0N/A * published by the Free Software Foundation.
0N/A *
0N/A * This code is distributed in the hope that it will be useful, but WITHOUT
0N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
0N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
0N/A * version 2 for more details (a copy is included in the LICENSE file that
0N/A * accompanied this code).
0N/A *
0N/A * You should have received a copy of the GNU General Public License version
0N/A * 2 along with this work; if not, write to the Free Software Foundation,
0N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
0N/A *
2362N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
2362N/A * or visit www.oracle.com if you need additional information or have any
2362N/A * questions.
0N/A */
0N/A
0N/Aimport java.io.*;
0N/Aimport java.util.*;
0N/Aimport java.security.MessageDigest;
0N/Aimport javax.xml.crypto.*;
0N/Aimport javax.xml.crypto.dsig.*;
0N/Aimport javax.xml.crypto.dsig.dom.DOMValidateContext;
0N/Aimport javax.xml.crypto.dom.*;
0N/Aimport javax.xml.parsers.DocumentBuilderFactory;
0N/Aimport javax.xml.parsers.DocumentBuilder;
0N/Aimport org.w3c.dom.Document;
0N/Aimport org.w3c.dom.Node;
0N/Aimport org.w3c.dom.NodeList;
0N/Aimport org.w3c.dom.Element;
0N/A
0N/A/**
0N/A * This is a class which performs xml signature validation upon request
0N/A */
0N/Aclass SignatureValidator {
0N/A
0N/A private File dir;
0N/A
0N/A SignatureValidator(File base) {
0N/A dir = base;
0N/A }
0N/A
0N/A boolean validate(String fn, KeySelector ks, boolean cache)
0N/A throws Exception {
0N/A return validate(fn, ks, null, cache);
0N/A }
0N/A
0N/A boolean validate(String fn, KeySelector ks, URIDereferencer ud,
0N/A boolean cache) throws Exception {
0N/A
0N/A DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
0N/A dbf.setNamespaceAware(true);
0N/A dbf.setValidating(false);
0N/A Document doc = dbf.newDocumentBuilder().parse(new File(dir, fn));
0N/A NodeList nl =
0N/A doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
0N/A if (nl.getLength() == 0) {
0N/A throw new Exception("Couldn't find signature Element");
0N/A }
0N/A Element sigElement = (Element) nl.item(0);
0N/A DOMValidateContext vc = new DOMValidateContext(ks, sigElement);
0N/A vc.setBaseURI(dir.toURI().toString());
0N/A if (cache) {
0N/A vc.setProperty("javax.xml.crypto.dsig.cacheReference", Boolean.TRUE);
0N/A }
0N/A XMLSignatureFactory factory = XMLSignatureFactory.getInstance();
0N/A XMLSignature signature = factory.unmarshalXMLSignature(vc);
0N/A if (ud != null) {
0N/A vc.setURIDereferencer(ud);
0N/A }
0N/A boolean coreValidity = signature.validate(vc);
0N/A
0N/A // Check reference cache
0N/A if (cache) {
0N/A Iterator i = signature.getSignedInfo().getReferences().iterator();
0N/A for (int j=0; i.hasNext(); j++) {
0N/A Reference ref = (Reference) i.next();
0N/A if (!digestInputEqual(ref)) {
0N/A throw new Exception
0N/A ("cached data for Reference[" + j + "] is not correct");
0N/A }
0N/A // check that dereferenced data does not contain comment nodes
0N/A if (ref.getURI() == "") {
0N/A System.out.println("checking deref data");
0N/A NodeSetData data = (NodeSetData) ref.getDereferencedData();
0N/A Iterator ni = data.iterator();
0N/A while (ni.hasNext()) {
0N/A Node n = (Node) ni.next();
0N/A if (n.getNodeType() == Node.COMMENT_NODE) {
0N/A throw new Exception("dereferenced data for " +
0N/A " Reference[" + j + " contains comment node");
0N/A }
0N/A }
0N/A }
0N/A }
0N/A }
0N/A return coreValidity;
0N/A }
0N/A
0N/A private boolean digestInputEqual(Reference ref) throws Exception {
0N/A MessageDigest md = MessageDigest.getInstance("SHA1");
0N/A InputStream is = ref.getDigestInputStream();
0N/A int nbytes;
0N/A byte[] buf = new byte[256];
0N/A while ((nbytes = is.read(buf, 0, buf.length)) != -1) {
0N/A md.update(buf, 0, nbytes);
0N/A }
0N/A return Arrays.equals(md.digest(), ref.getDigestValue());
0N/A }
0N/A}