[SANTUARIO-290] Add a secure validation switch for signature processing

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Java 1.5
• Security Level: Public (Public issues, viewable by everyone)
• Assignee: Colm O hEigeartaigh
• Reporter: Colm O hEigeartaigh
• Created: 08/Dec/11 11:27
• Updated: 14/May/18 10:30
• Resolved: 20/Jan/12 09:42

Description

This task describes new functionality available in the 1.5 library. It involves supporting a boolean switch, which defaults to false, which allows more secure validation of signatures. When enabled, this functionality implements the following constraints:

• Limits the number of Transforms per Reference to a maximum of 5.
• Does not allow XSLT transforms.
• Does not allow a RetrievalMethod to reference another RetrievalMethod.
• Does not allow a Reference to call the ResolverLocalFilesystem or
  the ResolverDirectHTTP (references to local files and HTTP resources
  are forbidden).
• Limits the number of references per Manifest (SignedInfo) to a maximum of 30.
• MD5 is not allowed as a SignatureAlgorithm or DigestAlgorithm.
• Guarantees that the Dereferenced Element returned via Document.getElementById is unique by performing a tree-search.

This functionality is supported in the core library through additional method signatures which take a boolean, and in the JSR-105 API via the property "org.apache.jcp.xml.dsig.secureValidation".

Issue Links

• is related to: SANTUARIO-327 Add a secure validation switch for streaming signature processing
• is related to: SANTUARIO-485 Configurable limit of references in secure validation mode