Examples with XMLSecAttribute org.apache.xml.security.stax.ext.stax.XMLSecAttribute used on opensource projects

Example 1 with XMLSecAttribute

use of org.apache.xml.security.stax.ext.stax.XMLSecAttribute in project santuario-java by apache.

the class AbstractSignatureEndingOutputProcessor method processHeaderEvent.

/*
        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="Signature-1022834285">
            <ds:SignedInfo>
                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
                <ds:Reference URI="#id-1612925417">
                    <ds:Transforms>
                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                    <ds:DigestValue>cy/khx5N6UobCJ1EbX+qnrGID2U=</ds:DigestValue>
                </ds:Reference>
                <ds:Reference URI="#Timestamp-1106985890">
                    <ds:Transforms>
                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                    <ds:DigestValue>+p5YRII6uvUdsJ7XLKkWx1CBewE=</ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue>
                Izg1FlI9oa4gOon2vTXi7V0EpiyCUazECVGYflbXq7/3GF8ThKGDMpush/fo1I2NVjEFTfmT2WP/
                +ZG5N2jASFptrcGbsqmuLE5JbxUP1TVKb9SigKYcOQJJ8klzmVfPXnSiRZmIU+DUT2UXopWnGNFL
                TwY0Uxja4ZuI6U8m8Tg=
            </ds:SignatureValue>
            <ds:KeyInfo Id="KeyId-1043455692">
                <wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="STRId-1008354042">
                    <wsse:Reference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                        URI="#CertId-3458500" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" />
                </wsse:SecurityTokenReference>
            </ds:KeyInfo>
        </ds:Signature>
    */
@Override
public void processHeaderEvent(OutputProcessorChain outputProcessorChain) throws XMLStreamException, XMLSecurityException {
    OutputProcessorChain subOutputProcessorChain = outputProcessorChain.createSubChain(this);
    List<XMLSecAttribute> attributes = new ArrayList<>(1);
    if (securityProperties.isSignatureGenerateIds()) {
        attributes = new ArrayList<>(1);
        attributes.add(createAttribute(XMLSecurityConstants.ATT_NULL_Id, IDGenerator.generateID(null)));
    } else {
        attributes = Collections.emptyList();
    }
    XMLSecStartElement signatureElement = createStartElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_Signature, true, attributes);
    SignatureAlgorithm signatureAlgorithm;
    try {
        signatureAlgorithm = SignatureAlgorithmFactory.getInstance().getSignatureAlgorithm(getSecurityProperties().getSignatureAlgorithm());
    } catch (NoSuchAlgorithmException e) {
        throw new XMLSecurityException(e);
    } catch (NoSuchProviderException e) {
        throw new XMLSecurityException(e);
    }
    String tokenId = outputProcessorChain.getSecurityContext().get(XMLSecurityConstants.PROP_USE_THIS_TOKEN_ID_FOR_SIGNATURE);
    if (tokenId == null) {
        throw new XMLSecurityException("stax.keyNotFound");
    }
    SecurityTokenProvider<OutboundSecurityToken> wrappingSecurityTokenProvider = outputProcessorChain.getSecurityContext().getSecurityTokenProvider(tokenId);
    if (wrappingSecurityTokenProvider == null) {
        throw new XMLSecurityException("stax.keyNotFound");
    }
    final OutboundSecurityToken wrappingSecurityToken = wrappingSecurityTokenProvider.getSecurityToken();
    if (wrappingSecurityToken == null) {
        throw new XMLSecurityException("stax.keyNotFound");
    }
    String sigAlgorithm = getSecurityProperties().getSignatureAlgorithm();
    Key key = wrappingSecurityToken.getSecretKey(sigAlgorithm);
    // todo remove and use wrappingSecurityToken.isSymmetric or so?
    if (XMLSecurityConstants.NS_XMLDSIG_HMACSHA1.equals(sigAlgorithm)) {
        key = XMLSecurityUtils.prepareSecretKey(sigAlgorithm, key.getEncoded());
    }
    signatureAlgorithm.engineInitSign(key);
    SignedInfoProcessor signedInfoProcessor = newSignedInfoProcessor(signatureAlgorithm, signatureElement, subOutputProcessorChain);
    createStartElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_SignedInfo, false, null);
    attributes = new ArrayList<>(1);
    final String signatureCanonicalizationAlgorithm = getSecurityProperties().getSignatureCanonicalizationAlgorithm();
    attributes.add(createAttribute(XMLSecurityConstants.ATT_NULL_Algorithm, signatureCanonicalizationAlgorithm));
    createStartElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_CanonicalizationMethod, false, attributes);
    if (getSecurityProperties().isAddExcC14NInclusivePrefixes() && XMLSecurityConstants.NS_C14N_EXCL.equals(signatureCanonicalizationAlgorithm)) {
        attributes = new ArrayList<>(1);
        attributes.add(createAttribute(XMLSecurityConstants.ATT_NULL_PrefixList, signedInfoProcessor.getInclusiveNamespacePrefixes()));
        createStartElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_c14nExcl_InclusiveNamespaces, true, attributes);
        createEndElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_c14nExcl_InclusiveNamespaces);
    }
    createEndElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_CanonicalizationMethod);
    attributes = new ArrayList<>(1);
    attributes.add(createAttribute(XMLSecurityConstants.ATT_NULL_Algorithm, getSecurityProperties().getSignatureAlgorithm()));
    createStartElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_SignatureMethod, false, attributes);
    createEndElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_SignatureMethod);
    Iterator<SignaturePartDef> signaturePartDefIterator = signaturePartDefList.iterator();
    while (signaturePartDefIterator.hasNext()) {
        SignaturePartDef signaturePartDef = signaturePartDefIterator.next();
        String uriString;
        if (signaturePartDef.isExternalResource()) {
            uriString = signaturePartDef.getSigRefId();
        } else if (signaturePartDef.getSigRefId() != null) {
            if (signaturePartDef.isGenerateXPointer()) {
                uriString = "#xpointer(id('" + signaturePartDef.getSigRefId() + "'))";
            } else {
                uriString = "#" + signaturePartDef.getSigRefId();
            }
        } else {
            uriString = "";
        }
        attributes = new ArrayList<>(1);
        attributes.add(createAttribute(XMLSecurityConstants.ATT_NULL_URI, uriString));
        createStartElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_Reference, false, attributes);
        createTransformsStructureForSignature(subOutputProcessorChain, signaturePartDef);
        attributes = new ArrayList<>(1);
        attributes.add(createAttribute(XMLSecurityConstants.ATT_NULL_Algorithm, signaturePartDef.getDigestAlgo()));
        createStartElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_DigestMethod, false, attributes);
        createEndElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_DigestMethod);
        createStartElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_DigestValue, false, null);
        createCharactersAndOutputAsEvent(subOutputProcessorChain, signaturePartDef.getDigestValue());
        createEndElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_DigestValue);
        createEndElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_Reference);
    }
    createEndElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_SignedInfo);
    subOutputProcessorChain.removeProcessor(signedInfoProcessor);
    createStartElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_SignatureValue, false, null);
    final byte[] signatureValue = signedInfoProcessor.getSignatureValue();
    createCharactersAndOutputAsEvent(subOutputProcessorChain, Base64.getMimeEncoder().encodeToString(signatureValue));
    createEndElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_SignatureValue);
    if (securityProperties.isSignatureGenerateIds()) {
        attributes = new ArrayList<>(1);
        attributes.add(createAttribute(XMLSecurityConstants.ATT_NULL_Id, IDGenerator.generateID(null)));
    } else {
        attributes = Collections.emptyList();
    }
    if (!SecurityTokenConstants.KeyIdentifier_NoKeyInfo.equals(getSecurityProperties().getSignatureKeyIdentifier())) {
        createStartElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_KeyInfo, false, attributes);
        createKeyInfoStructureForSignature(subOutputProcessorChain, wrappingSecurityToken, getSecurityProperties().isUseSingleCert());
        createEndElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_KeyInfo);
    }
    createEndElementAndOutputAsEvent(subOutputProcessorChain, XMLSecurityConstants.TAG_dsig_Signature);
}

Example 2 with XMLSecAttribute

use of org.apache.xml.security.stax.ext.stax.XMLSecAttribute in project santuario-java by apache.

the class XMLSignatureOutputProcessor method processEvent.

@Override
public void processEvent(XMLSecEvent xmlSecEvent, OutputProcessorChain outputProcessorChain) throws XMLStreamException, XMLSecurityException {
    if (xmlSecEvent.getEventType() == XMLStreamConstants.START_ELEMENT) {
        XMLSecStartElement xmlSecStartElement = xmlSecEvent.asStartElement();
        // avoid double signature when child elements matches too
        if (getActiveInternalSignatureOutputProcessor() == null) {
            SecurePart securePart = securePartMatches(xmlSecStartElement, outputProcessorChain, XMLSecurityConstants.SIGNATURE_PARTS);
            if (securePart != null) {
                LOG.debug("Matched securePart for signature");
                InternalSignatureOutputProcessor internalSignatureOutputProcessor = null;
                SignaturePartDef signaturePartDef = new SignaturePartDef();
                signaturePartDef.setSecurePart(securePart);
                signaturePartDef.setTransforms(securePart.getTransforms());
                if (signaturePartDef.getTransforms() == null) {
                    signaturePartDef.setTransforms(new String[] { XMLSecurityConstants.NS_C14N_EXCL_OMIT_COMMENTS });
                }
                signaturePartDef.setExcludeVisibleC14Nprefixes(true);
                signaturePartDef.setDigestAlgo(securePart.getDigestMethod());
                if (signaturePartDef.getDigestAlgo() == null) {
                    signaturePartDef.setDigestAlgo(getSecurityProperties().getSignatureDigestAlgorithm());
                }
                if (securityProperties.isSignatureGenerateIds()) {
                    if (securePart.getIdToSign() == null) {
                        signaturePartDef.setGenerateXPointer(securePart.isGenerateXPointer());
                        signaturePartDef.setSigRefId(IDGenerator.generateID(null));
                        Attribute attribute = xmlSecStartElement.getAttributeByName(securityProperties.getIdAttributeNS());
                        if (attribute != null) {
                            signaturePartDef.setSigRefId(attribute.getValue());
                        } else {
                            List<XMLSecAttribute> attributeList = new ArrayList<>(1);
                            attributeList.add(createAttribute(securityProperties.getIdAttributeNS(), signaturePartDef.getSigRefId()));
                            xmlSecEvent = addAttributes(xmlSecStartElement, attributeList);
                        }
                    } else {
                        signaturePartDef.setSigRefId(securePart.getIdToSign());
                    }
                }
                getSignaturePartDefList().add(signaturePartDef);
                internalSignatureOutputProcessor = new InternalSignatureOutputProcessor(signaturePartDef, xmlSecStartElement);
                internalSignatureOutputProcessor.setXMLSecurityProperties(getSecurityProperties());
                internalSignatureOutputProcessor.setAction(getAction());
                internalSignatureOutputProcessor.addAfterProcessor(XMLSignatureOutputProcessor.class.getName());
                internalSignatureOutputProcessor.addBeforeProcessor(XMLSignatureEndingOutputProcessor.class.getName());
                internalSignatureOutputProcessor.init(outputProcessorChain);
                setActiveInternalSignatureOutputProcessor(internalSignatureOutputProcessor);
            }
        }
    }
    outputProcessorChain.processEvent(xmlSecEvent);
}

Example 3 with XMLSecAttribute

use of org.apache.xml.security.stax.ext.stax.XMLSecAttribute in project santuario-java by apache.

the class Canonicalizer11 method getInitialUtilizedAttributes.

@Override
protected List<XMLSecAttribute> getInitialUtilizedAttributes(final XMLSecStartElement xmlSecStartElement, final C14NStack<XMLSecEvent> outputStack) {
    List<XMLSecAttribute> utilizedAttributes = Collections.emptyList();
    List<XMLSecAttribute> visibleAttributes = new ArrayList<>();
    xmlSecStartElement.getAttributesFromCurrentScope(visibleAttributes);
    for (int i = 0; i < visibleAttributes.size(); i++) {
        XMLSecAttribute comparableAttribute = visibleAttributes.get(i);
        final QName comparableAttributeName = comparableAttribute.getName();
        // xml:id attributes must be handled like other attributes: emit but dont inherit
        if (!XML.equals(comparableAttributeName.getPrefix())) {
            continue;
        }
        if ("id".equals(comparableAttributeName.getLocalPart()) || "base".equals(comparableAttributeName.getLocalPart())) {
            continue;
        }
        if (outputStack.containsOnStack(comparableAttribute) != null) {
            continue;
        }
        if (utilizedAttributes == Collections.<XMLSecAttribute>emptyList()) {
            utilizedAttributes = new ArrayList<>(2);
        }
        utilizedAttributes.add(comparableAttribute);
        outputStack.peek().add(comparableAttribute);
    }
    List<XMLSecAttribute> elementAttributes = xmlSecStartElement.getOnElementDeclaredAttributes();
    for (int i = 0; i < elementAttributes.size(); i++) {
        XMLSecAttribute comparableAttribute = elementAttributes.get(i);
        // attributes with xml prefix are already processed in the for loop above
        // xml:id attributes must be handled like other attributes: emit but dont inherit
        final QName attributeName = comparableAttribute.getName();
        if (XML.equals(attributeName.getPrefix())) {
            continue;
        }
        if (utilizedAttributes == Collections.<XMLSecAttribute>emptyList()) {
            utilizedAttributes = new ArrayList<>(2);
        }
        utilizedAttributes.add(comparableAttribute);
    }
    return utilizedAttributes;
}

Example 4 with XMLSecAttribute

use of org.apache.xml.security.stax.ext.stax.XMLSecAttribute in project santuario-java by apache.

the class AbstractOutputProcessor method createStartElementAndOutputAsEvent.

public XMLSecStartElement createStartElementAndOutputAsEvent(OutputProcessorChain outputProcessorChain, QName element, boolean outputLocalNs, List<XMLSecAttribute> attributes) throws XMLStreamException, XMLSecurityException {
    List<XMLSecNamespace> comparableNamespaces = Collections.emptyList();
    if (outputLocalNs) {
        comparableNamespaces = new ArrayList<>(2);
        comparableNamespaces.add(XMLSecEventFactory.createXMLSecNamespace(element.getPrefix(), element.getNamespaceURI()));
    }
    if (attributes != null) {
        for (int i = 0; i < attributes.size(); i++) {
            XMLSecAttribute xmlSecAttribute = attributes.get(i);
            QName attributeName = xmlSecAttribute.getName();
            String attributeNamePrefix = attributeName.getPrefix();
            if (attributeNamePrefix != null && attributeNamePrefix.isEmpty()) {
                continue;
            }
            if (!comparableNamespaces.contains(xmlSecAttribute.getAttributeNamespace())) {
                if (comparableNamespaces == Collections.<XMLSecNamespace>emptyList()) {
                    comparableNamespaces = new ArrayList<>(1);
                }
                comparableNamespaces.add(xmlSecAttribute.getAttributeNamespace());
            }
        }
    }
    XMLSecStartElement xmlSecStartElement = XMLSecEventFactory.createXmlSecStartElement(element, attributes, comparableNamespaces);
    outputAsEvent(outputProcessorChain, xmlSecStartElement);
    return xmlSecStartElement;
}

Example 5 with XMLSecAttribute

use of org.apache.xml.security.stax.ext.stax.XMLSecAttribute in project santuario-java by apache.

the class AbstractOutputProcessor method addAttributes.

public XMLSecStartElement addAttributes(XMLSecStartElement xmlSecStartElement, List<XMLSecAttribute> attributeList) throws XMLStreamException {
    List<XMLSecNamespace> declaredNamespaces = xmlSecStartElement.getOnElementDeclaredNamespaces();
    for (int i = 0; i < attributeList.size(); i++) {
        XMLSecAttribute xmlSecAttribute = attributeList.get(i);
        xmlSecStartElement.addAttribute(xmlSecAttribute);
        final QName attributeName = xmlSecAttribute.getName();
        if (attributeName.getNamespaceURI() != null && !"".equals(attributeName.getNamespaceURI()) && !declaredNamespaces.contains(xmlSecAttribute.getAttributeNamespace())) {
            xmlSecStartElement.addNamespace(xmlSecAttribute.getAttributeNamespace());
        }
    }
    return xmlSecStartElement;
}