[SANTUARIO-412] Signature verification fails because unutilized default namespace is not removed

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: Java 2.0.1, Java 2.0.3
• Fix Version/s: Java 2.0.4
• Component/s: Java
• Security Level: Public (Public issues, viewable by everyone)
• Environment: Webservice created with cxf 3.0.1, and running on java 7.
• Assignee: Colm O hEigeartaigh
• Reporter: Atle Tokle
• Created: 19/Jan/15 17:57
• Updated: 20/Apr/15 09:58
• Resolved: 05/Feb/15 09:51

Description

In a soap-message where body is encrypted and signed, we get a signature verification fault because of differently calculated digest.

The decrypted body is (anonyminized) like this: <urn:GetDataRequest xmlns="" xmlns:cont="http://www.company1.no/jade/xsd/v1.3/contexttypes" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:no:company2:area:domain:melding:DataMessage-1.0" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">123456789</urn:GetDataRequest>

When it's canonicalized using Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" it is like this:
<soapenv:Body xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Body-767cf61e-3cc1-45dc-b677-04720471d3b0">
<urn:GetDataRequest xmlns:urn="urn:no:company2:area:domain:melding:DataMessage-1.0" xmlns="">123456789</urn:GetDataRequest>
</soapenv:Body>

This give a different signature from what we got from sender. If we remove the namespace deifinition xmlns="", and create a digest, it is equal with what we get from sender.

From my understanding of http://www.w3.org/TR/xml-exc-c14n/ it is the sender that is correct.

I have tested a local patch where I did two changes on 2.0.3 source for org.apache.xml.security.c14n.implementations.Canonicalizer20010315Excl.java

line 184:
String NName = attribute.getLocalName();
changed to
String NName = attribute.getLocalName() == null ? "" : attribute.getLocalName();

line 187:
if (!XMLNS_URI.equals(attribute.getNamespaceURI())) {
changed to:
if (!XMLNS_URI.equals(attribute.getNamespaceURI()) &&
!(XMLNS.equals(attribute.getName()) && "".equals(NName) && "".equals(NNodeValue))) {

This fixed the problem for me, but don't know which regressions I might have introduced, or if really this new behaviour is the correct.