Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8012288

XML DSig API allows wrong tag names and extra elements in SignedInfo

    Details

    • Subcomponent:
    • Resolved In Build:
      b102
    • CPU:
      generic
    • OS:
      generic
    • Verification:
      Verified

      Backports

        Description

        XML Dsig implementation ignores tag names and extra elements in SignedInfo. For example, the following XML passes validation:

        ...
        <aSignedInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
        <aCanonicalizationMethod
        Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"></aCanonicalizationMethod>

        <aSignatureMethod
        Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"></aSignatureMethod>

        <aReference URI="">
        <Transforms>
              <aTransform
        Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></aTransform>

        </Transforms>
        <aDigestMethod
        Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></aDigestMethod>
        <aDigestValue>1Bq8FsjajUBYPD7stQeJSc66GlM=</aDigestValue>
            <test>some extra text</test>
        </aReference>
        </aSignedInfo>
        <aSignatureValue>cbNpPGavhM0...</aSignatureValue>
        ...

        Only Transforms tag is not affected.
        1. test.tar
          30 kB
          Artem Smotrakov

          Activity

          Hide
          asmotrak Artem Smotrakov added a comment -
          Affected SQE tests:

          xml/dsig/SecureValidation/Reference/ValidationTest_reference_extra_text_in_signed_info
          xml/dsig/SecureValidation/Reference/ValidationTest_reference_wrong_tag_names
          Show
          asmotrak Artem Smotrakov added a comment - Affected SQE tests: xml/dsig/SecureValidation/Reference/ValidationTest_reference_extra_text_in_signed_info xml/dsig/SecureValidation/Reference/ValidationTest_reference_wrong_tag_names
          Hide
          mullan Sean Mullan added a comment -
          The proper way to detect these types of errors is to validate the syntax of the XML Signature structure against the schema definition before validating the signature. This can be done using the javax.xml.validation APIs.

          That said, the implementation can also detect these types of errors, so we will make some changes to do that. It should be noted that these types of errors are not security issues, the implementation will correctly detect that the signature is invalid if the changes are made to the signed content.
          Show
          mullan Sean Mullan added a comment - The proper way to detect these types of errors is to validate the syntax of the XML Signature structure against the schema definition before validating the signature. This can be done using the javax.xml.validation APIs. That said, the implementation can also detect these types of errors, so we will make some changes to do that. It should be noted that these types of errors are not security issues, the implementation will correctly detect that the signature is invalid if the changes are made to the signed content.
          Hide
          hgupdate HG Updates added a comment -
          URL: http://hg.openjdk.java.net/jdk8/tl/jdk/rev/1744a32d3db3
          User: mullan
          Date: 2013-07-26 01:05:15 +0000
          Show
          hgupdate HG Updates added a comment - URL: http://hg.openjdk.java.net/jdk8/tl/jdk/rev/1744a32d3db3 User: mullan Date: 2013-07-26 01:05:15 +0000
          Hide
          hgupdate HG Updates added a comment -
          URL: http://hg.openjdk.java.net/jdk8/jdk8/jdk/rev/1744a32d3db3
          User: lana
          Date: 2013-08-06 17:34:56 +0000
          Show
          hgupdate HG Updates added a comment - URL: http://hg.openjdk.java.net/jdk8/jdk8/jdk/rev/1744a32d3db3 User: lana Date: 2013-08-06 17:34:56 +0000
          Hide
          rhalade Rajan Halade added a comment -
          Verified, affected SQE test did not fail since b102
          Show
          rhalade Rajan Halade added a comment - Verified, affected SQE test did not fail since b102

            People

            • Assignee:
              mullan Sean Mullan
              Reporter:
              asmotrak Artem Smotrakov
            • Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: