Error while signing a specific XML tag in java

Question

I need to sign a specific XML tag with java 1.6. My XML is like this:

My java code to sign it (excluding the keystore part) is:

    try {
    String ArqAssinar = "file.xml";
    String Charset = "UTF-8";

    /* URI and ID */
    String idRef = "1";
    String uriRef = "#" + idRef;

    XMLSignatureFactory XmlSignFac = XMLSignatureFactory.getInstance("DOM");

    DigestMethod DigMet = XmlSignFac.newDigestMethod(DigestMethod.SHA1, null);

    Transform TransfRef1 = XmlSignFac.newTransform(CanonicalizationMethod.INCLUSIVE, (TransformParameterSpec) null);
    Transform TransfRef2 = XmlSignFac.newTransform(SignatureMethod.RSA_SHA1, (C14NMethodParameterSpec) null);
    List Transfs = new ArrayList();
    Transfs.add(TransfRef1);
    Transfs.add(TransfRef2);

    /* Reference - where I use URI and ID */
    Reference Ref = XmlSignFac.newReference(uriRef, DigMet, Transfs, null, idRef);

    CanonicalizationMethod CannMet = XmlSignFac.newCanonicalizationMethod(CanonicalizationMethod.INCLUSIVE, (C14NMethodParameterSpec) null);
    SignatureMethod SignMet = XmlSignFac.newSignatureMethod(SignatureMethod.RSA_SHA1, null);

    /* SignedInfo - where I use Reference */
    SignedInfo SignInfo = XmlSignFac.newSignedInfo(CannMet, SignMet, Collections.singletonList(Ref));
    KeyInfoFactory keyInfFac = XmlSignFac.getKeyInfoFactory();

    List X509Content = new ArrayList();
    X509Content.add(Certif);

    X509Data X509dados = keyInfFac.newX509Data(X509Content);

    KeyInfo KeyInf = keyInfFac.newKeyInfo(Collections.singletonList(X509dados));

    /* Process file for input */
    DocumentBuilderFactory DocBuilderFactory = DocumentBuilderFactory.newInstance();
    DocBuilderFactory.setNamespaceAware(true);
    DocumentBuilder DocBuilder = DocBuilderFactory.newDocumentBuilder();
    InputStream Input = new FileInputStream(arq);
    Reader Leitor = new InputStreamReader(Input, Charset);
    InputSource Origem = new InputSource(Leitor);

    Document Doc = DocBuilder.parse(Origem);

    /* Search for tag in document using ID */
    XPathFactory factory = XPathFactory.newInstance();
    XPath xpathPesquisa = factory.newXPath();
    XPathExpression expr = xpathPesquisa.compile(String.format("//*[@id='%s']", idRef));
    NodeList nodes = (NodeList) expr.evaluate(docParaAssinar, XPathConstants.NODESET);
    Node Tag = null;
    DOMSignContext DocSignCont = null;
    XMLSignature Signature = null;

    if (nodes.getLength() != 0) {
        tagComId = nodes.item(0);
        Tag = tagComId.getParentNode();

        DocSignCont = new DOMSignContext(PrivPass, Tag);

        /* Do the signature */
        Signature = this.XmlSignFac.newXMLSignature(SignInfo, KeyInf);
        Signature.sign(DocSignCont);        

        /* Updates the file */      
        OutputStream Saida = new FileOutputStream(arqAtualizar);
        Writer Escritor = new OutputStreamWriter(Saida, Charset);
        StreamResult Resultado = new StreamResult(Escritor);
        TransformerFactory TransformFac = TransformerFactory.newInstance();
        Transformer Transf = TransformFac.newTransformer();
        Transf.transform(new DOMSource(docAssinado), Resultado);
    } else {
        . . .
    }
} catch (Exception E) {
    . . .
}

When I run this code in Eclipse I get a StackOverflow error inside the DOMXMLSignature.sign() method. There is a call for the DOMXMLSignature.digestReference() method, and the function calls itself indefinitely.

This code works if the URI is "" and ID is null, that is, when I need to sign the entire XML.

What do I need to do differently to get sign a specific XML tag?

I have had some problems with this code:

public final class DOMXMLSignature extends DOMStructure
implements XMLSignature {


@Override
public void sign(XMLSignContext signContext)
    throws MarshalException, XMLSignatureException
{
    if (signContext == null) {
        throw new NullPointerException("signContext cannot be null");
    }
    DOMSignContext context = (DOMSignContext)signContext;
    marshal(context.getParent(), context.getNextSibling(),
            DOMUtils.getSignaturePrefix(context), context);

    // generate references and signature value
    List allReferences = new ArrayList<>();

    // traverse the Signature and register all objects with IDs that
    // may contain References
    signatureIdMap = new HashMap<>();
    signatureIdMap.put(id, this);
    signatureIdMap.put(si.getId(), si);
    @SuppressWarnings("unchecked")
    List refs = si.getReferences();
    for (Reference ref : refs) {
        signatureIdMap.put(ref.getId(), ref);
    }
    for (XMLObject obj : objects) {
        signatureIdMap.put(obj.getId(), obj);
        @SuppressWarnings("unchecked")
        List content = obj.getContent();
        for (XMLStructure xs : content) {
            if (xs instanceof Manifest) {
                Manifest man = (Manifest)xs;
                signatureIdMap.put(man.getId(), man);
                @SuppressWarnings("unchecked")
                List manRefs = man.getReferences();
                for (Reference ref : manRefs) {
                    allReferences.add(ref);
                    signatureIdMap.put(ref.getId(), ref);
                }
            }
        }
    }
    // always add SignedInfo references after Manifest references so
    // that Manifest reference are digested first
    allReferences.addAll(refs);

    // generate/digest each reference
    for (Reference ref : allReferences) {
        digestReference((DOMReference)ref, signContext);
    }

    // do final sweep to digest any references that were skipped or missed
    for (Reference ref : allReferences) {
        if (((DOMReference)ref).isDigested()) {
            continue;
        }
        ((DOMReference)ref).digest(signContext);
    }

    Key signingKey = null;
    try {
        KeySelectorResult keySelectorResult = signContext.getKeySelector().select(ki,
                                                  KeySelector.Purpose.SIGN,
                                                  si.getSignatureMethod(),
                                                  signContext);
        signingKey = keySelectorResult.getKey();
        if (signingKey == null) {
            throw new XMLSignatureException("the keySelector did not " +
                                            "find a signing key");
        }
        ksr = keySelectorResult;
    } catch (KeySelectorException kse) {
        throw new XMLSignatureException("cannot find signing key", kse);
    }

    // calculate signature value
    try {
        byte[] val = ((AbstractDOMSignatureMethod)
            si.getSignatureMethod()).sign(signingKey, si, signContext);
        ((DOMSignatureValue)sv).setValue(val);
    } catch (InvalidKeyException ike) {
        throw new XMLSignatureException(ike);
    }

    this.localSigElem = sigElem;
}

private void digestReference(DOMReference ref, XMLSignContext signContext)
    throws XMLSignatureException
{
    if (ref.isDigested()) {
        return;
    }
    // check dependencies
    String uri = ref.getURI();
    if (Utils.sameDocumentURI(uri)) {
        String parsedId = Utils.parseIdFromSameDocumentURI(uri);
        if (parsedId != null && signatureIdMap.containsKey(parsedId)) {
            XMLStructure xs = signatureIdMap.get(parsedId);
            if (xs instanceof DOMReference) {
                digestReference((DOMReference)xs, signContext);
            } else if (xs instanceof Manifest) {
                Manifest man = (Manifest)xs;
                List manRefs = DOMManifest.getManifestReferences(man);
                for (int i = 0, size = manRefs.size(); i < size; i++) {
                    digestReference((DOMReference)manRefs.get(i),
                                    signContext);
                }
            }
        }
        // if uri="" and there are XPath Transforms, there may be
        // reference dependencies in the XPath Transform - so be on
        // the safe side, and skip and do at end in the final sweep
        if (uri.length() == 0) {
            List transforms = ref.getTransforms();
            for (Transform transform : transforms) {
                String transformAlg = transform.getAlgorithm();
                if (transformAlg.equals(Transform.XPATH) ||
                    transformAlg.equals(Transform.XPATH2)) {
                    return;
                }
            }
        }
    }
    ref.digest(signContext);
}

}

public final class Utils {

/**
 * Returns the ID from a same-document URI (ex: "#id")
 */
public static String parseIdFromSameDocumentURI(String uri) {
    if (uri.length() == 0) {
        return null;
    }
    String id = uri.substring(1);
    if (id != null && id.startsWith("xpointer(id(")) {
        int i1 = id.indexOf('\'');
        int i2 = id.indexOf('\'', i1+1);
        id = id.substring(i1+1, i2);
    }
    return id;
}

/**
 * Returns true if uri is a same-document URI, false otherwise.
 */
public static boolean sameDocumentURI(String uri) {
    return uri != null && (uri.length() == 0 || uri.charAt(0) == '#');
}

}

This is just a piece of the DOMXMLSignature class and the Util class, just the methods that matter to the case.

My code above class the DOMXMLSignature.sign() method. This method do the marshall, get the reference, get the reference id, the call DOMXMLSignature.digestReference() method.

The DOMXMLSignature.digestReference() method verify if the reference is alredy digested - it is not. So he get the URI, verifies if this is a same-document URI - it is - , confiorms that the id in document is the id in URI. Then, the problem: the instance obtainded with signatureIdMap.get(parsedId) is ALWAYS of the type DOMReference, so the method calls yourself indefinitely.

This was happening in the java 1.6, in native class with no change. How can I solve this problem and sign a specific XML tag? Will I have to calclulate the digestvalue before call the DOMXMLSignature.sign() method?

Error while signing a specific XML tag in java

Answers (1)

Related Questions