Skip to content

Commit 16e30f6

Browse files
vharsekovharseko
authored
[#730] Bump xml-sec 2.1.7 -> 3.0.4 (#732)
* [#730] Bump xml-sec 2.1.7 -> 2.2.6 Direct vulnerabilities: CVE-2023-44483 Vulnerabilities from dependencies: CVE-2023-36479 CVE-2023-33202 CVE-2023-33201 CVE-2023-26049 CVE-2023-26048 CVE-2022-40156 CVE-2022-40155 CVE-2022-40154 CVE-2022-40153 CVE-2022-40152 CVE-2022-34169 CVE-2022-23437 CVE-2021-34428 CVE-2021-28169 CVE-2021-28165 CVE-2020-27223 CVE-2020-27218 CVE-2020-14338 * <artifactId>xmlsec</artifactId><version>3.0.4</version> * error: package javax.xml.bind.annotation does not exist
1 parent 41c8adc commit 16e30f6

File tree

12 files changed

+122
-181
lines changed

12 files changed

+122
-181
lines changed

‎openam-federation/OpenFM/src/main/java/com/sun/identity/wss/security/KeyIdentifier.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@
3232
import java.security.cert.X509Certificate;
3333
import javax.xml.transform.TransformerException;
3434
import java.util.ResourceBundle;
35+
36+
import com.sun.identity.saml.xmlsig.AMSignatureProvider;
3537
import org.w3c.dom.Element;
3638
import org.w3c.dom.Document;
3739
import org.w3c.dom.Text;
@@ -186,8 +188,7 @@ public Element getTokenElement(Document doc) throws SecurityException {
186188
doc, "//*[@ID=\"" + value + "\"]");
187189
} else {
188190
Element nscontext =
189-
org.apache.xml.security.utils.
190-
XMLUtils.createDSctx(doc, WSSConstants.WSU_TAG,
191+
AMSignatureProvider.createDSctx(doc, WSSConstants.WSU_TAG,
191192
WSSConstants.WSU_NS);
192193
tokenElement = (Element) XPathAPI.selectSingleNode(
193194
doc, "//*[@" + "wsu:Id" + "=\"" + value + "\"]");

‎openam-federation/OpenFM/src/main/java/com/sun/identity/wss/security/STRTransform.java

Lines changed: 59 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,9 @@
2929

3030
package com.sun.identity.wss.security;
3131

32+
import java.io.ByteArrayOutputStream;
3233
import java.io.IOException;
34+
import java.io.OutputStream;
3335
import java.security.cert.X509Certificate;
3436
import org.w3c.dom.Document;
3537
import org.w3c.dom.Element;
@@ -44,6 +46,9 @@
4446
import org.apache.xml.security.transforms.TransformationException;
4547
import org.apache.xml.security.keys.content.X509Data;
4648
import com.sun.identity.shared.xml.XMLUtils;
49+
import org.xml.sax.SAXException;
50+
51+
import javax.xml.parsers.ParserConfigurationException;
4752

4853
/**
4954
* This class <code>STRTransform</code> extends from <code>TransformSpi</code>
@@ -67,13 +72,64 @@ public class STRTransform extends TransformSpi {
6772
}
6873
}
6974

75+
76+
7077
/**
7178
* Returns the transformation engine URI.
7279
*/
7380
protected String engineGetURI() {
7481
return STR_TRANSFORM_URI;
7582
}
7683

84+
@Override
85+
protected XMLSignatureInput enginePerformTransform(XMLSignatureInput input, OutputStream outputStream, Element element, String s, boolean b) throws IOException, CanonicalizationException, InvalidCanonicalizerException, TransformationException, ParserConfigurationException, SAXException {
86+
WSSUtils.debug.message("STRTransform.enginePerformTransform:: Start");
87+
//Document doc = transformObject.getDocument();
88+
Element str = null;
89+
if(input.isElement()) {
90+
} else {
91+
WSSUtils.debug.error("STRTransform.enginePerformTransform:: Input" +
92+
" is not an element");
93+
throw new CanonicalizationException(
94+
WSSUtils.bundle.getString("invalidElement"));
95+
}
96+
//Element element = (Element)input.getSubNode();
97+
if(!WSSConstants.TAG_SECURITYTOKEN_REFERENCE.equals(
98+
element.getLocalName())) {
99+
WSSUtils.debug.error("STRTransform.enginePerformTransform:: input" +
100+
" must be security token reference");
101+
throw new IOException(
102+
WSSUtils.bundle.getString("invalidElement"));
103+
}
104+
Element dereferencedToken = null;
105+
SecurityTokenReference ref = null;
106+
try {
107+
ref = new SecurityTokenReference(element);
108+
//dereferencedToken = dereferenceSTR(doc, ref);
109+
dereferencedToken=element;
110+
} catch (SecurityException se) {
111+
WSSUtils.debug.error("STRTransform.enginePerformTransform:: error",
112+
se);
113+
throw new TransformationException(
114+
WSSUtils.bundle.getString("transformfailed"));
115+
}
116+
String canonAlgo = s;//getCanonicalizationAlgo(transformObject);
117+
Canonicalizer canon = Canonicalizer.getInstance(canonAlgo);
118+
ByteArrayOutputStream os=new ByteArrayOutputStream();
119+
canon.canonicalizeSubtree(dereferencedToken, "#default",os);
120+
StringBuffer bf = new StringBuffer(new String(os.toByteArray()));
121+
String bf1 = bf.toString();
122+
123+
int lt = bf1.indexOf("<");
124+
int gt = bf1.indexOf(">");
125+
int idx = bf1.indexOf(XMLNS);
126+
if (idx < 0 || idx > gt) {
127+
idx = bf1.indexOf(" ");
128+
bf.insert(idx + 1, "xmlns=\"\" ");
129+
bf1 = bf.toString();
130+
}
131+
return new XMLSignatureInput(bf1.getBytes());
132+
}
77133
/**
78134
* Perform the XMLSignature transformation for the given input.
79135
*/
@@ -112,8 +168,9 @@ protected XMLSignatureInput enginePerformTransform(XMLSignatureInput input, Tran
112168
}
113169
String canonAlgo = getCanonicalizationAlgo(transformObject);
114170
Canonicalizer canon = Canonicalizer.getInstance(canonAlgo);
115-
byte[] buf = canon.canonicalizeSubtree(dereferencedToken, "#default");
116-
StringBuffer bf = new StringBuffer(new String(buf));
171+
ByteArrayOutputStream os=new ByteArrayOutputStream();
172+
canon.canonicalizeSubtree(dereferencedToken, "#default",os);
173+
StringBuffer bf = new StringBuffer(new String(os.toByteArray()));
117174
String bf1 = bf.toString();
118175

119176
int lt = bf1.indexOf("<");

‎openam-federation/OpenFM/src/main/java/com/sun/identity/wss/security/SecurityTokenReference.java

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@
3131

3232
import java.util.ResourceBundle;
3333
import javax.xml.transform.TransformerException;
34+
35+
import com.sun.identity.saml.xmlsig.AMSignatureProvider;
3436
import org.w3c.dom.Document;
3537
import org.w3c.dom.Element;
3638
import org.w3c.dom.Node;
@@ -238,9 +240,8 @@ public Element getTokenElement(Document doc) throws SecurityException {
238240
tokenElement = (Element) XPathAPI.selectSingleNode(
239241
doc, "//*[@ID=\"" + uri + "\"]");
240242
} else {
241-
Element nscontext =
242-
org.apache.xml.security.utils.
243-
XMLUtils.createDSctx(doc, WSSConstants.WSU_TAG,
243+
Element nscontext =
244+
AMSignatureProvider.createDSctx(doc, WSSConstants.WSU_TAG,
244245
WSSConstants.WSU_NS);
245246
tokenElement = (Element) XPathAPI.selectSingleNode(
246247
doc, "//*[@" + "wsu:Id" + "=\"" + uri + "\"]");

‎openam-federation/OpenFM/src/main/java/com/sun/identity/wss/security/WSSUtils.java

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
package com.sun.identity.wss.security;
3131

3232
import java.io.ByteArrayInputStream;
33+
import java.io.ByteArrayOutputStream;
3334
import java.util.Set;
3435
import java.util.Collection;
3536
import java.util.ResourceBundle;
@@ -1108,10 +1109,11 @@ public static Element getCanonicalElement(Node node) {
11081109
try {
11091110
Canonicalizer c14n = Canonicalizer.getInstance(
11101111
"http://www.w3.org/2001/10/xml-exc-c14n#");
1111-
byte outputBytes[] = c14n.canonicalizeSubtree(node);
1112+
ByteArrayOutputStream os=new ByteArrayOutputStream();
1113+
c14n.canonicalizeSubtree(node,os);
11121114
DocumentBuilder documentBuilder = XMLUtils.getSafeDocumentBuilder(false);
11131115
Document doc = documentBuilder.parse(
1114-
new ByteArrayInputStream(outputBytes));
1116+
new ByteArrayInputStream(os.toByteArray()));
11151117
Element result = doc.getDocumentElement();
11161118
return result;
11171119
} catch (Exception e) {

‎openam-federation/OpenFM/src/main/java/com/sun/identity/wss/xmlsig/WSSSignatureProvider.java

Lines changed: 7 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -196,8 +196,7 @@ public org.w3c.dom.Element signWithSAMLToken(
196196
WSSUtils.bundle.getString("invalidalgorithm"));
197197
}
198198
}
199-
Element wsucontext = org.apache.xml.security.utils.
200-
XMLUtils.createDSctx(doc, "wsu", WSSConstants.WSU_NS);
199+
Element wsucontext = AMSignatureProvider.createDSctx(doc, "wsu", WSSConstants.WSU_NS);
201200

202201
NodeList wsuNodes = (NodeList)XPathAPI.selectNodeList(doc,
203202
"//*[@wsu:Id]", wsucontext);
@@ -429,8 +428,7 @@ private org.w3c.dom.Element signWithBinarySecurityToken(
429428
SAMLUtils.bundle.getString("invalidalgorithm"));
430429
}
431430

432-
Element wsucontext = org.apache.xml.security.utils.
433-
XMLUtils.createDSctx(doc, "wsu", WSSConstants.WSU_NS);
431+
Element wsucontext = AMSignatureProvider.createDSctx(doc, "wsu", WSSConstants.WSU_NS);
434432

435433
NodeList wsuNodes = (NodeList)XPathAPI.selectNodeList(doc,
436434
"//*[@wsu:Id]", wsucontext);
@@ -575,8 +573,7 @@ public boolean verifyWSSSignature(org.w3c.dom.Document doc,
575573
}
576574

577575
try {
578-
Element wsucontext = org.apache.xml.security.utils.
579-
XMLUtils.createDSctx(doc, "wsu", WSSConstants.WSU_NS);
576+
Element wsucontext = AMSignatureProvider.createDSctx(doc, "wsu", WSSConstants.WSU_NS);
580577

581578
NodeList wsuNodes = (NodeList)XPathAPI.selectNodeList(doc,
582579
"//*[@wsu:Id]", wsucontext);
@@ -603,8 +600,7 @@ public boolean verifyWSSSignature(org.w3c.dom.Document doc,
603600
}
604601
}
605602

606-
Element nscontext = org.apache.xml.security.utils.
607-
XMLUtils.createDSctx (doc,"ds",Constants.SignatureSpecNS);
603+
Element nscontext = AMSignatureProvider.createDSctx (doc,"ds",Constants.SignatureSpecNS);
608604
NodeList sigElements = XPathAPI.selectNodeList (doc,
609605
"//ds:Signature", nscontext);
610606
int sigElementsLength = sigElements.getLength();
@@ -733,8 +729,7 @@ private PublicKey getPublicKeyFromWSSToken(Document doc) {
733729
return null;
734730
}
735731

736-
Element nscontext = org.apache.xml.security.utils.
737-
XMLUtils.createDSctx(doc,"ds",Constants.SignatureSpecNS);
732+
Element nscontext = AMSignatureProvider.createDSctx(doc,"ds",Constants.SignatureSpecNS);
738733
Element sigElement = (Element) XPathAPI.selectSingleNode(
739734
securityElement, "ds:Signature[1]", nscontext);
740735

@@ -750,8 +745,7 @@ private PublicKey getPublicKeyFromWSSToken(Document doc) {
750745
if (reference != null) {
751746
String id = reference.getAttribute(SAMLConstants.TAG_URI);
752747
id = id.substring(1);
753-
nscontext = org.apache.xml.security.utils.
754-
XMLUtils.createDSctx(doc,SAMLConstants.PREFIX_WSU,
748+
nscontext = AMSignatureProvider.createDSctx(doc,SAMLConstants.PREFIX_WSU,
755749
WSSConstants.WSU_NS);
756750
Node n = XPathAPI.selectSingleNode(
757751
doc, "//*[@"+ SAMLConstants.PREFIX_WSU + ":" +
@@ -853,8 +847,7 @@ public org.w3c.dom.Element signWithKerberosToken(
853847
SAMLUtils.bundle.getString("invalidalgorithm"));
854848
}
855849

856-
Element wsucontext = org.apache.xml.security.utils.
857-
XMLUtils.createDSctx(doc, "wsu", WSSConstants.WSU_NS);
850+
Element wsucontext = AMSignatureProvider.createDSctx(doc, "wsu", WSSConstants.WSU_NS);
858851

859852
NodeList wsuNodes = (NodeList)XPathAPI.selectNodeList(doc,
860853
"//*[@wsu:Id]", wsucontext);

‎openam-federation/openam-federation-library/src/main/java/com/sun/identity/saml/common/SAMLUtils.java

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131

3232
import static org.forgerock.openam.utils.Time.*;
3333

34+
import java.io.*;
3435
import java.util.Collections;
3536
import java.util.Date;
3637
import java.util.Map;
@@ -45,10 +46,6 @@
4546

4647
import java.text.StringCharacterIterator;
4748
import java.text.CharacterIterator;
48-
import java.io.UnsupportedEncodingException;
49-
import java.io.PrintWriter;
50-
import java.io.IOException;
51-
import java.io.ByteArrayInputStream;
5249

5350
import java.security.MessageDigest;
5451

@@ -1716,11 +1713,12 @@ public static Element getCanonicalElement(Node node) {
17161713
try {
17171714
Canonicalizer c14n = Canonicalizer.getInstance(
17181715
"http://www.w3.org/TR/2001/REC-xml-c14n-20010315");
1719-
byte outputBytes[] = c14n.canonicalizeSubtree(node);
1720-
DocumentBuilder documentBuilder =
1716+
ByteArrayOutputStream os=new ByteArrayOutputStream();
1717+
c14n.canonicalizeSubtree(node,os);
1718+
DocumentBuilder documentBuilder =
17211719
XMLUtils.getSafeDocumentBuilder(false);
17221720
Document doc = documentBuilder.parse(
1723-
new ByteArrayInputStream(outputBytes));
1721+
new ByteArrayInputStream(os.toByteArray()));
17241722
Element result = doc.getDocumentElement();
17251723
return result;
17261724
} catch (Exception e) {

‎openam-federation/openam-federation-library/src/main/java/com/sun/identity/saml/xmlsig/AMSignatureProvider.java

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -755,6 +755,17 @@ public Element signWithWSSSAMLTokenProfile(Document doc,
755755
ids, SOAPBindingConstants.WSF_10_VERSION);
756756
}
757757

758+
public static Element createDSctx(Document doc, String prefix, String namespace) {
759+
if ((prefix == null) || (prefix.trim().length() == 0)) {
760+
throw new IllegalArgumentException("You must supply a prefix");
761+
}
762+
763+
Element ctx = doc.createElementNS(null, "namespaceContext");
764+
765+
ctx.setAttributeNS(Constants.NamespaceSpecNS, "xmlns:" + prefix.trim(), namespace);
766+
767+
return ctx;
768+
}
758769
/**
759770
* Sign part of the xml document referered by the supplied a list
760771
* of id attributes of nodes
@@ -805,8 +816,7 @@ public Element signWithWSSSAMLTokenProfile(Document doc,
805816
XMLSignature signature = null;
806817
try {
807818
ElementProxy.setDefaultPrefix(Constants.SignatureSpecNS, SAMLConstants.PREFIX_DS);
808-
Element wsucontext = org.apache.xml.security.utils.
809-
XMLUtils.createDSctx(doc, "wsu", wsuNS);
819+
Element wsucontext = createDSctx(doc, "wsu", wsuNS);
810820
NodeList wsuNodes = (NodeList)XPathAPI.selectNodeList(doc,
811821
"//*[@wsu:Id]", wsucontext);
812822
if(wsuNodes != null && wsuNodes.getLength() != 0) {
@@ -945,8 +955,7 @@ public Element signWithWSSX509TokenProfile(Document doc,
945955
XMLSignature signature = null;
946956
try {
947957
ElementProxy.setDefaultPrefix(Constants.SignatureSpecNS, SAMLConstants.PREFIX_DS);
948-
Element wsucontext = org.apache.xml.security.utils.
949-
XMLUtils.createDSctx(doc, "wsu", wsuNS);
958+
Element wsucontext = createDSctx(doc, "wsu", wsuNS);
950959
NodeList wsuNodes = (NodeList)XPathAPI.selectNodeList(doc,
951960
"//*[@wsu:Id]", wsucontext);
952961
if ((wsuNodes != null) && (wsuNodes.getLength() != 0)) {
@@ -1073,7 +1082,7 @@ public boolean verifyXMLSignature(String wsfVersion, String certAlias,
10731082
wsseNS = WSSEConstants.NS_WSSE_WSF11;
10741083
}
10751084

1076-
Element wsucontext = org.apache.xml.security.utils.XMLUtils.createDSctx(doc, "wsu", wsuNS);
1085+
Element wsucontext = createDSctx(doc, "wsu", wsuNS);
10771086

10781087
NodeList wsuNodes = (NodeList) XPathAPI.selectNodeList(doc, "//*[@wsu:Id]", wsucontext);
10791088

@@ -1087,8 +1096,7 @@ public boolean verifyXMLSignature(String wsfVersion, String certAlias,
10871096
}
10881097
}
10891098

1090-
Element nscontext = org.apache.xml.security.utils.
1091-
XMLUtils.createDSctx (doc,"ds",Constants.SignatureSpecNS);
1099+
Element nscontext = createDSctx (doc,"ds",Constants.SignatureSpecNS);
10921100
NodeList sigElements = XPathAPI.selectNodeList (doc,
10931101
"//ds:Signature", nscontext);
10941102
if (SAMLUtilsCommon.debug.messageEnabled()) {
@@ -1388,8 +1396,7 @@ public boolean verifyXMLSignature(Document doc,
13881396
java.lang.String certAlias)
13891397
throws XMLSignatureException {
13901398
try {
1391-
Element nscontext = org.apache.xml.security.utils.
1392-
XMLUtils.createDSctx(doc,"ds",Constants.SignatureSpecNS);
1399+
Element nscontext = createDSctx(doc,"ds",Constants.SignatureSpecNS);
13931400
Element sigElement = (Element) XPathAPI.selectSingleNode(doc,
13941401
"//ds:Signature[1]", nscontext);
13951402
Element refElement;
@@ -1564,8 +1571,7 @@ private PublicKey getWSSTokenProfilePublicKey(Document doc) {
15641571
return null;
15651572
}
15661573

1567-
Element nscontext = org.apache.xml.security.utils.
1568-
XMLUtils.createDSctx(doc,"ds",Constants.SignatureSpecNS);
1574+
Element nscontext = createDSctx(doc,"ds",Constants.SignatureSpecNS);
15691575
Element sigElement = (Element) XPathAPI.selectSingleNode(
15701576
securityElement, "ds:Signature[1]",
15711577
nscontext);
@@ -1580,8 +1586,7 @@ private PublicKey getWSSTokenProfilePublicKey(Document doc) {
15801586
if (reference != null) {
15811587
String id = reference.getAttribute(SAMLConstants.TAG_URI);
15821588
id = id.substring(1);
1583-
nscontext = org.apache.xml.security.utils.
1584-
XMLUtils.createDSctx(doc, SAMLConstants.PREFIX_WSU, wsuNS);
1589+
nscontext = createDSctx(doc, SAMLConstants.PREFIX_WSU, wsuNS);
15851590
Node n = XPathAPI.selectSingleNode(
15861591
doc, "//*[@"+ SAMLConstants.PREFIX_WSU + ":" +
15871592
SAMLConstants.TAG_ID +"=\"" + id + "\"]", nscontext);

‎openam-federation/openam-federation-library/src/main/java/com/sun/identity/saml2/meta/SAML2MetaSecurityUtils.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@
4040

4141
import javax.xml.bind.JAXBException;
4242

43+
import com.sun.identity.saml.xmlsig.AMSignatureProvider;
4344
import com.sun.identity.saml2.jaxb.metadata.KeyDescriptorType;
4445
import com.sun.identity.saml2.jaxb.metadata.SSODescriptorType;
4546
import org.forgerock.openam.utils.CollectionUtils;
@@ -241,7 +242,7 @@ public static void verifySignature(Document doc)
241242
NodeList sigElements = null;
242243
try {
243244
Element nscontext =
244-
org.apache.xml.security.utils.XMLUtils
245+
AMSignatureProvider
245246
.createDSctx (doc,"ds", Constants.SignatureSpecNS);
246247
sigElements =
247248
XPathAPI.selectNodeList(doc, "//ds:Signature", nscontext);

‎openam-federation/openam-federation-library/src/main/java/com/sun/identity/saml2/xmlsig/FMSigProvider.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636

3737
import javax.xml.xpath.XPathException;
3838

39+
import com.sun.identity.saml.xmlsig.AMSignatureProvider;
3940
import org.forgerock.openam.utils.StringUtils;
4041
import org.w3c.dom.Document;
4142
import org.w3c.dom.Node;
@@ -256,7 +257,7 @@ public boolean verify(
256257
);
257258
}
258259
Element nscontext =
259-
org.apache.xml.security.utils.XMLUtils.
260+
AMSignatureProvider.
260261
createDSctx(doc, "ds", Constants.SignatureSpecNS);
261262
Element sigElement = null;
262263
try {

0 commit comments

Comments
 (0)