Java 类javax.xml.crypto.dsig.dom.DOMValidateContext 实例源码

public Result validate ( final Document doc ) throws Exception
{
    final NodeList nl = doc.getElementsByTagNameNS ( XMLSignature.XMLNS, "Signature" ); //$NON-NLS-1$

    if ( nl.getLength () == 0 )
    {
        return new Result ( StatusCodes.VALIDATE_NO_SIGNATURE_DATA, "No signature data found" );
    }

    final DOMValidateContext dvc = new DOMValidateContext ( this.keySelector, nl.item ( 0 ) );

    final XMLSignature signature = this.factory.unmarshalXMLSignature ( dvc );

    try
    {
        final boolean result = signature.validate ( dvc );

        return new Result ( result, signature );
    }
    catch ( final XMLSignatureException e )
    {
        logger.debug ( "Failed to perform validation", e );
        return Result.INVALID;
    }
}

@org.junit.Test
public void testCreateDSA2048Signature() throws Exception {

    // check if SHA256withDSA is supported
    boolean gotSHA256withDSA = false;
    try {
        Signature.getInstance("SHA256withDSA");
        gotSHA256withDSA = true;
    } catch (NoSuchAlgorithmException e) {}
    org.junit.Assume.assumeTrue(gotSHA256withDSA);

    SignatureMethod sm = fac.newSignatureMethod(DSA_SHA256, null);
    SignedInfo si = createSignedInfo(sm);
    KeyInfo ki = kifac.newKeyInfo(Collections.singletonList
        (kifac.newKeyValue((PublicKey)TestUtils.getPublicKey("DSA", 2048))));
    XMLSignature sig = fac.newXMLSignature(si, ki, objs, id, sigValueId);
    Document doc = TestUtils.newDocument();
    XMLSignContext signContext =
        new DOMSignContext(TestUtils.getPrivateKey("DSA", 2048), doc);
    signContext.setURIDereferencer(ud);
    sig.sign(signContext);
    XMLValidateContext validateContext = new DOMValidateContext
        (TestUtils.getPublicKey("DSA", 2048), doc.getDocumentElement());
    validateContext.setURIDereferencer(ud);
    assertTrue(sig.validate(validateContext));
}

public boolean validate(DOMValidateContext vc) throws Exception {

        XMLSignatureFactory factory = XMLSignatureFactory.getInstance
            ("DOM", new org.apache.jcp.xml.dsig.internal.dom.XMLDSigRI());
        XMLSignature signature = factory.unmarshalXMLSignature(vc);
        boolean coreValidity = signature.validate(vc);

        // Check core validation status
        if (coreValidity == false) {
            // check the validation status of each Reference
            @SuppressWarnings("unchecked")
            Iterator<Reference> i = signature.getSignedInfo().getReferences().iterator();
            while (i.hasNext()) {
                Reference reference = i.next();
                reference.validate(vc);
            }
        }
        return coreValidity;
    }

public static XMLValidateContext getXMLValidateContext(String type,
                                                   File input,
                                                   String tag)
    throws Exception {
    if (type.equalsIgnoreCase("dom")) {
        DocumentBuilder docBuilder = XMLUtils.createDocumentBuilder(false, false);
        Document doc = docBuilder.parse(input);
        if (tag == null) {
            return new DOMValidateContext
                (TestUtils.getPublicKey("RSA", 512),
                 doc.getDocumentElement());
        } else {
            NodeList list = doc.getElementsByTagName(tag);
            return new DOMValidateContext
                (TestUtils.getPublicKey("RSA", 512), list.item(0));
        }
    } else {
        throw new Exception("Unsupported XMLValidateContext type: " + type);
    }
}

@org.junit.Test
public void testLocalFilesystem() throws Exception {
    String file = "signature-external-c14n-xmlatrs.xml";

    DOMValidateContext vc =
        validator.getValidateContext(
            file, new KeySelectors.SecretKeySelector("secret".getBytes("ASCII"))
        );

    vc.setProperty("org.apache.jcp.xml.dsig.secureValidation", Boolean.FALSE);
    boolean coreValidity = validator.validate(vc);
    assertTrue("Signature failed core validation", coreValidity);

    vc.setProperty("org.apache.jcp.xml.dsig.secureValidation", Boolean.TRUE);

    try {
        validator.validate(vc);
        fail("Failure expected when secure validation is enabled");
    } catch (XMLSignatureException ex) {
        assertTrue(ex.getMessage().contains("URIReferenceException"));
    }
}

private static String explainValidationProblem(
    DOMValidateContext context, XMLSignature signature)
        throws XMLSignatureException {
  @SuppressWarnings("unchecked")  // Safe by specification.
  List<Reference> references = signature.getSignedInfo().getReferences();
  StringBuilder builder = new StringBuilder();
  builder.append("Signature failed core validation\n");
  boolean sv = signature.getSignatureValue().validate(context);
  builder.append("Signature validation status: " + sv + "\n");
  for (Reference ref : references) {
    builder.append("references[");
    builder.append(ref.getURI());
    builder.append("] validity status: ");
    builder.append(ref.validate(context));
    builder.append("\n");
  }
  return builder.toString();
}

/**
 * Verification via the default JSR105 implementation triggers some
 * canonicalization errors.
 * 
 * @param odfUrl
 * @param signatureNode
 * @throws MarshalException
 * @throws XMLSignatureException
 */
private boolean verifySignature(URL odfUrl, Node signatureNode) throws MarshalException, XMLSignatureException {

    // work-around for Java 7
    Element signedPropertiesElement = (Element) ((Element) signatureNode)
            .getElementsByTagNameNS(XAdESXLSignatureFacet.XADES_NAMESPACE, "SignedProperties").item(0);
    if (null != signedPropertiesElement) {
        signedPropertiesElement.setIdAttribute("Id", true);
    }

    DOMValidateContext domValidateContext = new DOMValidateContext(new KeyInfoKeySelector(), signatureNode);
    ODFURIDereferencer dereferencer = new ODFURIDereferencer(odfUrl);
    domValidateContext.setURIDereferencer(dereferencer);
    XMLSignatureFactory xmlSignatureFactory = XMLSignatureFactory.getInstance();
    LOG.debug("java version: " + System.getProperty("java.version"));
    /*
     * Requires Java 6u10 because of a bug. See also:
     * http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6696582
     */
    XMLSignature xmlSignature = xmlSignatureFactory.unmarshalXMLSignature(domValidateContext);
    boolean validity = xmlSignature.validate(domValidateContext);
    return validity;
}

@Test(expected = DigitalSignatureValidationException.class)
public void validate_error() throws Exception {
    // given
    FileInputStream in = null;
    Document document = null;
    try {
        in = new FileInputStream(FILE_OPENAM_RESPONSE);
        document = XMLConverter.convertToDocument(in);
    } finally {
        if (in != null) {
            in.close();
        }
    }
    NodeList nl = document.getElementsByTagNameNS(XMLSignature.XMLNS,
            "Signature");
    doThrow(new XMLSignatureException("")).when(validator)
            .workaroundOpenamBug(any(XMLSignature.class),
                    any(DOMValidateContext.class), anyBoolean());

    // when
    validator.validate(nl.item(0));

    // then exception expected
}

/**
 * Check the xmldsig signature of the XML document.
 *
 * @param document  the document to test
 * @param publicKey the public key corresponding to the key pair the document was signed with
 * @return true if a correct signature is present, false otherwise
 */
public static boolean validSignature(Document document, Key publicKey) {
    Node signatureNode = document.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature").item(0);
    KeySelector keySelector = KeySelector.singletonKeySelector(publicKey);

    try {
        String providerName =
                System.getProperty("jsr105Provider", "org.jcp.xml.dsig.internal.dom.XMLDSigRI");
        XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM",
                (Provider) Class.forName(providerName).newInstance());
        DOMValidateContext valContext = new DOMValidateContext(keySelector, signatureNode);

        XMLSignature signature = fac.unmarshalXMLSignature(valContext);
        return signature.validate(valContext);
    } catch (Exception e) {
        logger.warn("Error validating an XML signature.", e);
        return false;
    }
}

public boolean isValid() throws Exception {
    NodeList nodes = xmlDoc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");

    if (nodes == null || nodes.getLength() == 0) {
        throw new Exception("Can't find signature in document.");
    }

    if (setIdAttributeExists()) {
        tagIdAttributes(xmlDoc);
    }

    X509Certificate cert = samlSettings.getCertificate();
    DOMValidateContext ctx = new DOMValidateContext(cert.getPublicKey(), nodes.item(0));
    XMLSignatureFactory sigF = XMLSignatureFactory.getInstance("DOM");
    XMLSignature xmlSignature = sigF.unmarshalXMLSignature(ctx);

    return xmlSignature.validate(ctx);
}

public boolean isValida(final InputStream xmlStream) throws Exception {
    final DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
    dbf.setNamespaceAware(true);

    final Document document = dbf.newDocumentBuilder().parse(xmlStream);
    final NodeList nodeList = document.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
    if (nodeList.getLength() == 0) {
        throw new IllegalStateException("Nao foi encontrada a assinatura do XML.");
    }

    final String providerName = System.getProperty("jsr105Provider", "org.jcp.xml.dsig.internal.dom.XMLDSigRI");
    final XMLSignatureFactory signatureFactory = XMLSignatureFactory.getInstance("DOM", (Provider) Class.forName(providerName).newInstance());
    final DOMValidateContext validateContext = new DOMValidateContext(new X509KeySelector(), nodeList.item(0));

    for (final String tag : AssinaturaDigital.ELEMENTOS_ASSINAVEIS) {
        final NodeList elements = document.getElementsByTagName(tag);
        if (elements.getLength() > 0) {
            validateContext.setIdAttributeNS((Element) elements.item(0), null, "Id");
        }
    }

    return signatureFactory.unmarshalXMLSignature(validateContext).validate(validateContext);
}

public synchronized boolean validate()
        throws MarshalException,
        XMLSignatureException {

    // Find Signature element.
    NodeList list = document.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
    if (list.getLength() == 0) {
        throw new RuntimeException("Cannot find Signature element");
    }

    // Create a DOMValidateContext and specify a KeySelector
    // and document context.
    DOMValidateContext validateContext = new DOMValidateContext(new X509CertificateKeySelector(), list.item(0));

    // Unmarshal the XMLSignature.
    XMLSignature signature = this.signatureFactory.unmarshalXMLSignature(validateContext);

    // Validate the XMLSignature.
    if (signature.validate(validateContext)) {
        return true;
    } else {
        Iterator<?> i = signature.getSignedInfo().getReferences().iterator();
        for (int j = 0; i.hasNext(); j++) {
            System.out.print("ref[" + j + "] -> ");
            Reference ref = (Reference) i.next();
            System.out.print(ref.getURI());
            System.out.print(", ");
            System.out.print(ref.getDigestMethod().toString());
            System.out.print(", ");
            System.out.print(ref.getId());
            boolean refValid = ref.validate(validateContext);
            System.out.print(", validity status: " + refValid + "\r\n");
        }
        return false;
    }
}

public static boolean verifySignature(Document doc , X509Certificate cert) {
    try{
        if (doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature").getLength() == 0)
            throw new Exception("Cannot find Signature element");

        DOMValidateContext valContext = new DOMValidateContext(cert.getPublicKey(), doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature").item(0));

        XMLSignature signature = XMLSignatureFactory.getInstance("DOM").unmarshalXMLSignature(valContext);

        return signature.validate(valContext); 
    }catch(Exception e){e.printStackTrace();}
    return false;
}

private boolean validate(final DOMValidateContext validationContext)
        throws DigitalSignatureValidationException {

    try {
        // if (getLogger().isDebugLoggingEnabled()) {
        // enableReferenceCaching(validationContext);
        // }

        XMLSignatureFactory factory = XMLSignatureFactory
                .getInstance(XML_MECHANISM_TYPE);
        XMLSignature signature = factory
                .unmarshalXMLSignature(validationContext);
        boolean validationResult = signature.validate(validationContext);

        validationResult = workaroundOpenamBug(signature,
                validationContext, validationResult);

        // if (getLogger().isDebugLoggingEnabled()) {
        // debugLogReferences(signature, validationContext);
        // }
        return validationResult;
    } catch (XMLSignatureException | MarshalException exception) {
        throw new DigitalSignatureValidationException(
                "Error occurred during digital signature validation process",
                DigitalSignatureValidationException.ReasonEnum.EXCEPTION_OCCURRED,
                exception);
    }
}

/**
 * The overall signature validation consists of two steps, one is the
 * validation of the signature itself and the other the validation of the
 * references digest values. Because of a canonicalization bug in openam,
 * which is not yet registered, the second verification cannot be done.
 * 
 * @return true if the signature validation has not failed, even if the
 *         reference validation failed.
 */
boolean workaroundOpenamBug(XMLSignature signature,
        DOMValidateContext validationContext, boolean validationResult)
        throws XMLSignatureException {
    if (!validationResult) {
        if (signature.getSignatureValue().validate(validationContext)) {
            return true;
        }
    }
    return validationResult;
}

public XMLSignature unmarshalXMLSignature(XMLValidateContext context)
    throws MarshalException {

    if (context == null) {
        throw new NullPointerException("context cannot be null");
    }
    return unmarshal(((DOMValidateContext) context).getNode(), context);
}

public XMLSignature unmarshalXMLSignature(XMLValidateContext context)
    throws MarshalException {

    if (context == null) {
        throw new NullPointerException("context cannot be null");
    }
    return unmarshal(((DOMValidateContext) context).getNode(), context);
}

boolean validate(String fn, KeySelector ks, URIDereferencer ud,
    boolean cache) throws Exception {

    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
    dbf.setNamespaceAware(true);
    dbf.setValidating(false);
    Document doc = dbf.newDocumentBuilder().parse(new File(dir, fn));
    NodeList nl =
        doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
    if (nl.getLength() == 0) {
        throw new Exception("Couldn't find signature Element");
    }
    Element sigElement = (Element) nl.item(0);
    DOMValidateContext vc = new DOMValidateContext(ks, sigElement);
    vc.setBaseURI(dir.toURI().toString());
    if (cache) {
        vc.setProperty("javax.xml.crypto.dsig.cacheReference", Boolean.TRUE);
    }
    XMLSignatureFactory factory = XMLSignatureFactory.getInstance();
    XMLSignature signature = factory.unmarshalXMLSignature(vc);
    if (ud != null) {
        vc.setURIDereferencer(ud);
    }
    boolean coreValidity = signature.validate(vc);

    // Check reference cache
    if (cache) {
        Iterator i = signature.getSignedInfo().getReferences().iterator();
        for (int j=0; i.hasNext(); j++) {
            Reference ref = (Reference) i.next();
            if (!digestInputEqual(ref)) {
                throw new Exception
                    ("cached data for Reference[" + j + "] is not correct");
            }
            // check that dereferenced data does not contain comment nodes
            if (ref.getURI() == "") {
                System.out.println("checking deref data");
                NodeSetData data = (NodeSetData) ref.getDereferencedData();
                Iterator ni = data.iterator();
                while (ni.hasNext()) {
                    Node n = (Node) ni.next();
                    if (n.getNodeType() == Node.COMMENT_NODE) {
                        throw new Exception("dereferenced data for " +
                            " Reference[" + j + " contains comment node");
                    }
                }
            }
        }
    }
    return coreValidity;
}

public XMLSignature unmarshalXMLSignature(XMLValidateContext context)
    throws MarshalException {

    if (context == null) {
        throw new NullPointerException("context cannot be null");
    }
    return unmarshal(((DOMValidateContext) context).getNode(), context);
}

public static void main(String[] args) throws Exception {
    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
    dbf.setNamespaceAware(true);
    dbf.setValidating(false);
    dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
    Document doc = dbf.newDocumentBuilder().parse(new File(SIGNATURE));
    NodeList nl = doc.getElementsByTagNameNS(XMLSignature.XMLNS,
            "Signature");
    if (nl.getLength() == 0) {
        throw new RuntimeException("Couldn't find 'Signature' element");
    }
    Element element = (Element) nl.item(0);

    byte[] keyBytes = Base64.getDecoder().decode(validationKey);
    X509EncodedKeySpec spec = new X509EncodedKeySpec(keyBytes);
    KeyFactory kf = KeyFactory.getInstance("RSA");
    PublicKey key = kf.generatePublic(spec);
    KeySelector ks = KeySelector.singletonKeySelector(key);

    DOMValidateContext vc = new DOMValidateContext(ks, element);

    // disable secure validation mode
    vc.setProperty("org.jcp.xml.dsig.secureValidation", Boolean.FALSE);

    // set a dummy dereferencer to be able to get content by references
    vc.setURIDereferencer(dereferencer);

    XMLSignatureFactory factory = XMLSignatureFactory.getInstance();
    XMLSignature signature = factory.unmarshalXMLSignature(vc);

    // run validation
    signature.validate(vc);
}

public XMLSignature unmarshalXMLSignature(XMLValidateContext context)
    throws MarshalException {

    if (context == null) {
        throw new NullPointerException("context cannot be null");
    }
    return unmarshal(((DOMValidateContext) context).getNode(), context);
}

public static void main(String[] args) throws Exception {
    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
    dbf.setNamespaceAware(true);
    dbf.setValidating(false);
    dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
    Document doc = dbf.newDocumentBuilder().parse(new File(SIGNATURE));
    NodeList nl = doc.getElementsByTagNameNS(XMLSignature.XMLNS,
            "Signature");
    if (nl.getLength() == 0) {
        throw new RuntimeException("Couldn't find 'Signature' element");
    }
    Element element = (Element) nl.item(0);

    byte[] keyBytes = Base64.getDecoder().decode(validationKey);
    X509EncodedKeySpec spec = new X509EncodedKeySpec(keyBytes);
    KeyFactory kf = KeyFactory.getInstance("RSA");
    PublicKey key = kf.generatePublic(spec);
    KeySelector ks = KeySelector.singletonKeySelector(key);

    DOMValidateContext vc = new DOMValidateContext(ks, element);

    // disable secure validation mode
    vc.setProperty("org.jcp.xml.dsig.secureValidation", Boolean.FALSE);

    // set a dummy dereferencer to be able to get content by references
    vc.setURIDereferencer(dereferencer);

    XMLSignatureFactory factory = XMLSignatureFactory.getInstance();
    XMLSignature signature = factory.unmarshalXMLSignature(vc);

    // run validation
    signature.validate(vc);
}

/**
 * Utility function to validate XML Signature to do a self check
 * @param signed request 
 * @return
 */
private boolean validateXmlDSig(String signed, X509Certificate cert){
    try {
        DocumentBuilderFactory dbf = 
                  DocumentBuilderFactory.newInstance(); 
        dbf.setNamespaceAware(true);

        DocumentBuilder builder = dbf.newDocumentBuilder();  
        Document doc = builder.parse(new ByteArrayInputStream(signed.getBytes("utf-8")));
        NodeList signatureNodeList = doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
        NodeList bodyNodeList = doc.getElementsByTagNameNS("http://schemas.xmlsoap.org/soap/envelope/", "Body");

        if (signatureNodeList.getLength() == 0) {
          throw new Exception("Cannot find Signature element");
        }
        DOMValidateContext valContext = new DOMValidateContext(cert.getPublicKey(), signatureNodeList.item(0));
        valContext.setIdAttributeNS((Element)bodyNodeList.item(0),"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd","Id");

        XMLSignatureFactory factory = 
                  XMLSignatureFactory.getInstance("DOM");
        XMLSignature signature = 
                  factory.unmarshalXMLSignature(valContext);
        boolean coreValidity = signature.validate(valContext); 

        /* 
        //detailed validation - use when solving validity problems
        boolean sv = signature.getSignatureValue().validate(valContext);
        Iterator<Reference> i = signature.getSignedInfo().getReferences().iterator();
        for (int j=0; i.hasNext(); j++) {
          boolean refValid = ( i.next()).validate(valContext);
        } 
        */

        return coreValidity;
    }
    catch (Exception e){
        throw new IllegalArgumentException("validation failes", e);
    }
}

@Override
public XMLSignature unmarshalXMLSignature(XMLValidateContext context)
    throws MarshalException {

    if (context == null) {
        throw new NullPointerException("context cannot be null");
    }
    return unmarshal(((DOMValidateContext) context).getNode(), context);
}

private void test_create_signature_enveloping(
    SignatureMethod sm, DigestMethod dm, KeyInfo ki, Key signingKey, KeySelector ks
) throws Exception {

    // create reference
    Reference ref = fac.newReference("#DSig.Object_1", dm, null,
                                     XMLObject.TYPE, null);

    // create SignedInfo
    SignedInfo si = fac.newSignedInfo(withoutComments, sm,
                                      Collections.singletonList(ref));

    Document doc = db.newDocument();
    // create Objects
    Element webElem = doc.createElementNS(null, "Web");
    Text text = doc.createTextNode("up up and away");
    webElem.appendChild(text);
    XMLObject obj = fac.newXMLObject(Collections.singletonList
                                     (new DOMStructure(webElem)), "DSig.Object_1", "text/xml", null);

    // create XMLSignature
    XMLSignature sig = fac.newXMLSignature
    (si, ki, Collections.singletonList(obj), null, null);

    DOMSignContext dsc = new DOMSignContext(signingKey, doc);
    dsc.setDefaultNamespacePrefix("dsig");

    sig.sign(dsc);
    TestUtils.validateSecurityOrEncryptionElement(doc.getDocumentElement());

    // XMLUtils.outputDOM(doc.getDocumentElement(), System.out);

    DOMValidateContext dvc = new DOMValidateContext
    (ks, doc.getDocumentElement());
    XMLSignature sig2 = fac.unmarshalXMLSignature(dvc);

    assertTrue(sig.equals(sig2));
    assertTrue(sig2.validate(dvc));
}

public DOMValidateContext getValidateContext(String fn, KeySelector ks)
    throws Exception {
    Document doc = XMLUtils.createDocumentBuilder(false, false).parse(new File(dir, fn));
    Element sigElement = getSignatureElement(doc);
    if (sigElement == null) {
        throw new Exception("Couldn't find signature Element");
    }
    DOMValidateContext vc = new DOMValidateContext(ks, sigElement);
    vc.setBaseURI(dir.toURI().toString());
    return vc;
}

public boolean validate(String fn, KeySelector ks, URIDereferencer ud)
    throws Exception {

    DOMValidateContext vc = getValidateContext(fn, ks);
    if (ud != null) {
        vc.setURIDereferencer(ud);
    }

    return validate(vc);
}

/**
 * Validates a signature that references an element with an ID attribute.
 * The element's ID needs to be registered so that it can be found.
 */
@org.junit.Test
public void test_signature_with_ID() throws Exception {
    String file = "envelopingSignature.xml";

    DOMValidateContext vc = validator.getValidateContext
        (file, new KeySelectors.KeyValueKeySelector());
    Document doc = vc.getNode().getOwnerDocument();
    NodeList nl = doc.getElementsByTagName("Assertion");
    vc.setIdAttributeNS((Element) nl.item(0), null, "AssertionID");
    boolean coreValidity = validator.validate(vc);
    assertTrue("Signature failed core validation", coreValidity);
}

private void test_create_signature_enveloping(
    SignatureMethod sm, DigestMethod dm, KeyInfo ki, Key signingKey, KeySelector ks
) throws Exception {

    // create reference
    Reference ref = fac.newReference("#DSig.Object_1", dm, null,
                                     XMLObject.TYPE, null);

    // create SignedInfo
    SignedInfo si = fac.newSignedInfo(withoutComments, sm,
                                      Collections.singletonList(ref));

    Document doc = db.newDocument();
    // create Objects
    Element webElem = doc.createElementNS(null, "Web");
    Text text = doc.createTextNode("up up and away");
    webElem.appendChild(text);
    XMLObject obj = fac.newXMLObject(Collections.singletonList
                                     (new DOMStructure(webElem)), "DSig.Object_1", "text/xml", null);

    // create XMLSignature
    XMLSignature sig = fac.newXMLSignature
    (si, ki, Collections.singletonList(obj), null, null);

    DOMSignContext dsc = new DOMSignContext(signingKey, doc);
    dsc.setDefaultNamespacePrefix("dsig");

    sig.sign(dsc);
    TestUtils.validateSecurityOrEncryptionElement(doc.getDocumentElement());

    // XMLUtils.outputDOM(doc.getDocumentElement(), System.out);

    DOMValidateContext dvc = new DOMValidateContext
    (ks, doc.getDocumentElement());
    XMLSignature sig2 = fac.unmarshalXMLSignature(dvc);

    assertTrue(sig.equals(sig2));
    assertTrue(sig2.validate(dvc));
}

@org.junit.Test
public void testWrappingAttack() throws Exception {
    String file = "manifestSignatureWrapping.xml";

    Document doc = XMLUtils.createDocumentBuilder(false, false).parse(new File(dir, file));
    Element sigElement = SignatureValidator.getSignatureElement(doc);
    if (sigElement == null) {
        throw new Exception("Couldn't find signature Element");
    }
    DOMValidateContext vc =
        new DOMValidateContext(new KeySelectors.KeyValueKeySelector(), sigElement);
    vc.setBaseURI(dir.toURI().toString());

    vc.setProperty("org.apache.jcp.xml.dsig.secureValidation", Boolean.FALSE);
    boolean coreValidity = validator.validate(vc);
    assertTrue("Signature failed core validation", coreValidity);

    vc.setProperty("org.apache.jcp.xml.dsig.secureValidation", Boolean.TRUE);

    Element manifestElement =
        (Element) doc.getElementsByTagName("Manifest").item(0);
    vc.setIdAttributeNS(manifestElement, null, "Id");

    try {
        boolean valid = validator.validate(vc);
        System.out.println("Valid: " + valid);
        fail("Failure expected when secure validation is enabled");
    } catch (XMLSignatureException ex) {
        assertTrue(ex.getMessage().contains("URIReferenceException"));
    }
}

private void test_create_signature_enveloping(
    SignatureMethod sm, DigestMethod dm, KeyInfo ki, Key signingKey, KeySelector ks
) throws Exception {

    // create reference
    Reference ref = fac.newReference("#DSig.Object_1", dm, null,
                                     XMLObject.TYPE, null);

    // create SignedInfo
    SignedInfo si = fac.newSignedInfo(withoutComments, sm,
                                      Collections.singletonList(ref));

    Document doc = db.newDocument();
    // create Objects
    Element webElem = doc.createElementNS(null, "Web");
    Text text = doc.createTextNode("up up and away");
    webElem.appendChild(text);
    XMLObject obj = fac.newXMLObject(Collections.singletonList
                                     (new DOMStructure(webElem)), "DSig.Object_1", "text/xml", null);

    // create XMLSignature
    XMLSignature sig = fac.newXMLSignature
    (si, ki, Collections.singletonList(obj), null, null);

    DOMSignContext dsc = new DOMSignContext(signingKey, doc);
    dsc.setDefaultNamespacePrefix("dsig");

    sig.sign(dsc);
    TestUtils.validateSecurityOrEncryptionElement(doc.getDocumentElement());

    // XMLUtils.outputDOM(doc.getDocumentElement(), System.out);

    DOMValidateContext dvc = new DOMValidateContext
    (ks, doc.getDocumentElement());
    XMLSignature sig2 = fac.unmarshalXMLSignature(dvc);

    assertTrue(sig.equals(sig2));
    assertTrue(sig2.validate(dvc));
}

public XMLValidateContextTest() throws Exception {
    // set up the default XMLValidateContext
    SecretKey sk = new SecretKeySpec(new byte[8], "DES");
    defContext = new DOMValidateContext(sk, TestUtils.newDocument());

    // set up the key selectors
    KEY_SELECTORS = new KeySelector[1];
    KEY_SELECTORS[0] = KeySelector.singletonKeySelector(sk);
}

public DOMValidateContextTest() throws Exception {
    String fs = System.getProperty("file.separator");
    String base = System.getProperty("basedir") == null ? "./": System.getProperty("basedir");
    File dir = new File(base + fs +
        "src/test/resources" + fs + "ie" + fs + "baltimore" + fs + "merlin-examples",
        "merlin-xmldsig-twenty-three");
    File input = new File(dir, "signature.xml");
    domVC = (DOMValidateContext)
        TestUtils.getXMLValidateContext("DOM", input, "Reference");
}

@org.junit.Test
public void testConstructor() throws Exception {
    assertNotNull(domVC);
    try {
        new DOMValidateContext(TestUtils.getPublicKey("RSA"), null);
        fail("Should throw a NPE for null node");
    } catch (NullPointerException npe) {
    } catch (Exception ex) {
        fail("Should throw a NPE instead of " + ex + " for null node");
    }
}

@org.junit.Test
public void test_create_signature_enveloped_dsa() throws Exception {
    // create SignedInfo
    SignedInfo si = fac.newSignedInfo
        (withoutComments, dsaSha1, Collections.singletonList
            (fac.newReference
                ("", sha1, Collections.singletonList
                    (fac.newTransform(Transform.ENVELOPED,
                     (TransformParameterSpec) null)),
             null, null)));

    // create XMLSignature
    XMLSignature sig = fac.newXMLSignature(si, dsa);

    Document doc = db.newDocument();
    Element envelope = doc.createElementNS
        ("http://example.org/envelope", "Envelope");
    envelope.setAttributeNS
        (Constants.NamespaceSpecNS, "xmlns", "http://example.org/envelope");
    doc.appendChild(envelope);

    DOMSignContext dsc = new DOMSignContext(signingKey, envelope);

    sig.sign(dsc);
    TestUtils.validateSecurityOrEncryptionElement(envelope.getFirstChild());

    DOMValidateContext dvc = new DOMValidateContext
        (kvks, envelope.getFirstChild());
    XMLSignature sig2 = fac.unmarshalXMLSignature(dvc);

    assertTrue(sig.equals(sig2));

    assertTrue(sig2.validate(dvc));
}

private void test_create_signature_enveloping
    (SignatureMethod sm, KeyInfo ki, Key signingKey, KeySelector ks,
    boolean b64) throws Exception {

    // create reference
    Reference ref;
    if (b64) {
        ref = fac.newReference("#object", sha1, Collections.singletonList
            (fac.newTransform(Transform.BASE64,
             (TransformParameterSpec) null)), null, null);
    } else {
        ref = fac.newReference("#object", sha1);
    }

    // create SignedInfo
    SignedInfo si = fac.newSignedInfo(withoutComments, sm,
        Collections.singletonList(ref));

    Document doc = db.newDocument();
    // create Objects
    XMLObject obj = fac.newXMLObject(Collections.singletonList
        (new DOMStructure(doc.createTextNode("some text"))),
        "object", null, null);

    // create XMLSignature
    XMLSignature sig = fac.newXMLSignature
        (si, ki, Collections.singletonList(obj), null, null);

    DOMSignContext dsc = new DOMSignContext(signingKey, doc);

    sig.sign(dsc);
    TestUtils.validateSecurityOrEncryptionElement(doc.getDocumentElement());

    DOMValidateContext dvc = new DOMValidateContext
        (ks, doc.getDocumentElement());
    XMLSignature sig2 = fac.unmarshalXMLSignature(dvc);

    assertTrue(sig.equals(sig2));
    assertTrue(sig2.validate(dvc));
}

@org.junit.Test
public void test_signature_dsa_detached() throws Exception {
    String file = "signature-dsa-detached.xml";

    DOMValidateContext vc = validator.getValidateContext
    (file, new KeySelectors.RawX509KeySelector());
    vc.setProperty("javax.xml.crypto.dsig.cacheReference", Boolean.TRUE);
    vc.setURIDereferencer(ud);

    boolean coreValidity = validator.validate(vc);
    assertTrue("Signature failed core validation", coreValidity);
}

@org.junit.Test
public void test_signature_rsa_detached() throws Exception {
    String file = "signature-rsa-detached.xml";

    DOMValidateContext vc = validator.getValidateContext
        (file, new KeySelectors.RawX509KeySelector());
    vc.setProperty("javax.xml.crypto.dsig.cacheReference", Boolean.TRUE);
    vc.setURIDereferencer(ud);
    boolean coreValidity = validator.validate(vc);
    assertTrue("Signature failed core validation", coreValidity);
}

public XMLSignature unmarshalXMLSignature(XMLValidateContext context)
    throws MarshalException {

    if (context == null) {
        throw new NullPointerException("context cannot be null");
    }
    return unmarshal(((DOMValidateContext) context).getNode(), context);
}

public XMLSignature unmarshalXMLSignature(XMLValidateContext context)
    throws MarshalException {

    if (context == null) {
        throw new NullPointerException("context cannot be null");
    }
    return unmarshal(((DOMValidateContext) context).getNode(), context);
}