From 8a9d8238bd8f903393ff1184aa37f8973c81e2ba Mon Sep 17 00:00:00 2001 From: Miklos Vajna Date: Mon, 8 Apr 2019 21:37:23 +0200 Subject: [PATCH] tdf#123747 xmlsecurity, ODF sign roundtrip: preserve invalid reference type Only add the correct type to new signatures to avoid breaking the hash of old ones. Change-Id: I30f892b292f84a0575a3d4ef5ccf3eddbe0090ca Reviewed-on: https://gerrit.libreoffice.org/70424 Tested-by: Jenkins Reviewed-by: Miklos Vajna --- include/svl/sigstruct.hxx | 5 +- xmlsecurity/inc/xsecctl.hxx | 7 ++- .../qa/unit/signing/data/notype-xades.odt | Bin 0 -> 13918 bytes xmlsecurity/qa/unit/signing/signing.cxx | 59 ++++++++++++++++++ xmlsecurity/source/helper/ooxmlsecparser.cxx | 2 +- xmlsecurity/source/helper/xsecctl.cxx | 4 +- xmlsecurity/source/helper/xsecparser.cxx | 4 +- xmlsecurity/source/helper/xsecsign.cxx | 17 ++--- xmlsecurity/source/helper/xsecverify.cxx | 6 +- 9 files changed, 85 insertions(+), 19 deletions(-) create mode 100644 xmlsecurity/qa/unit/signing/data/notype-xades.odt diff --git a/include/svl/sigstruct.hxx b/include/svl/sigstruct.hxx index 3498aff008fa..ceed929752ab 100644 --- a/include/svl/sigstruct.hxx +++ b/include/svl/sigstruct.hxx @@ -48,6 +48,8 @@ struct SignatureReferenceInformation // For ODF: XAdES digests (SHA256) or the old SHA1, from css::xml::crypto::DigestID sal_Int32 nDigestID; OUString ouDigestValue; + /// Type of the reference: an URI (newer idSignedProperties references) or empty. + OUString ouType; SignatureReferenceInformation() : nType(SignatureReferenceType::SAMEDOCUMENT), @@ -57,12 +59,13 @@ struct SignatureReferenceInformation { } - SignatureReferenceInformation( SignatureReferenceType type, sal_Int32 digestID, const OUString& uri ) : + SignatureReferenceInformation( SignatureReferenceType type, sal_Int32 digestID, const OUString& uri, const OUString& rType ) : SignatureReferenceInformation() { nType = type; nDigestID = digestID; ouURI = uri; + ouType = rType; } }; diff --git a/xmlsecurity/inc/xsecctl.hxx b/xmlsecurity/inc/xsecctl.hxx index d5570a525b67..151de483371d 100644 --- a/xmlsecurity/inc/xsecctl.hxx +++ b/xmlsecurity/inc/xsecctl.hxx @@ -89,10 +89,10 @@ public: xReferenceResolvedListener = xListener; } - void addReference( SignatureReferenceType type, sal_Int32 digestID, const OUString& uri, sal_Int32 keeperId ) + void addReference( SignatureReferenceType type, sal_Int32 digestID, const OUString& uri, sal_Int32 keeperId, const OUString& rType ) { signatureInfor.vSignatureReferenceInfors.push_back( - SignatureReferenceInformation(type, digestID, uri)); + SignatureReferenceInformation(type, digestID, uri, rType)); vKeeperIds.push_back( keeperId ); } }; @@ -260,7 +260,8 @@ private: void switchGpgSignature(); void addReference( const OUString& ouUri, - sal_Int32 nDigestID ); + sal_Int32 nDigestID, + const OUString& ouType ); void addStreamReference( const OUString& ouUri, bool isBinary, diff --git a/xmlsecurity/qa/unit/signing/data/notype-xades.odt b/xmlsecurity/qa/unit/signing/data/notype-xades.odt new file mode 100644 index 0000000000000000000000000000000000000000..4f96d4bd89c055364e8b4fecd6fb02073b878689 GIT binary patch literal 13918 zcmdUWWmsIxwryj;3u_z{bMH#M#5% z1ZZz>ZD9m-wy?8haJ4n2w*xv^IMLhLo7fuL8M)Y)*gDfYo47kG{x=xRe}R3{O#XBX z1^|db{x_J3Gmzfh#yToNru-`-a`4R)#wS#YN;xm0#=dkCdo`v~pCIJNY1#Oo8m>T)IlotJyz*=Ffkk~Gdx_oa5`r@b z#yo;eK$JIV+|g3)>Ybdii!w~%r~-y(WCGO~bpunh=i*HRCkl0_iVk=>6{7fEgzVuK0Ubr1E`|z6`xQONM6s0nhsAR;Z?usADq` zrZ6as1PIatR;|z2hMB1ZlX61+1e{r4TUYIqF`vdbL^#~g_#Tip{lNaniGL(me2;J> z@HHoXy|G^tOvT*A#?TgMVeQ1={6~}C-qtKkQCe59B5P-dU3rXpS*rBL zuxsmSm)>Fje`w`Ao9|oTO9I8dyaoUuB_=QWP1qpdkH6&~Q#GhxtUKU!!Xq#O0Ka1H z;`D2>9%(JbEHt3_o#+F1?R|1gelEKo^>Wof*YFuQ(b+nUL2G5(uqRN)CJ3C* zuEe5~Nhh||is#A#jkPk% z{6t~-sp!ykC`04;K_r;XP6X2~q})2$XHRr>LlHOvpM1Zr&98DxiZkzse!kjA}bP3Fbc>h2`D%K4kyO{PZ}(Tkl8 zWqf#I{HDZh8$k^C6eRX3$A|OO3u#q41GFE7JZZAqSx-j}gymI)P^zNthi9tS*wqcf zsRg>3VEX9b(8SRA`O(_uIbLSIFi-=HiXh^JH7L08FKTQn~`400}|JaMFHrJ19& zK`McQ6427oD^O8`9!p?Di4d|lo>JY6cP{(If~>G?3Ly5?_@=^eUDfOQmi`WyIcjOZ z02M`mC90{o^>lJ)40CV0;h41HrFClEAYa6zcaPl*zX$7AN72lq_;F5DU!e= zBR0tarVc$=50@{*9qf~(AHASAv6mi8N3ZcysOgIgz8mF_V6xJKI*iKq8n>s95Z<1Hu#jypvG7y{-%E!Q~nCh0r?;{i^SYtj;s= zGtpc!u{d)Mxt1~3eJwq*o=hO4kBG~NHHcCdBs!GeX8i?oVAm2cs=Z^Dz{R7Yh_IWK z>`|gXIlGC12Z`s9-CqPPr(md4$V5-N?v2;pZ6r8zfB*Kzq06Z#=bQdfxbA@uQ0_f! zN32D8O3#piQZ^A{-n}##6f=K}-F2mn;Mdi(W`w*vEqcDH@J zzgc8( zBtF6zawc(SuQV~DKF(?3iEHgWe2K-QY9p~MFGq8J(^gZ_o{4y9)?WY_LAqN;JnDfU zL;05b%l?n1)RPlP3O)H7d1#1fIh=hpvMG-P7Vm(MEBT*S*m=3!impDi%2fJ$Ld0%) zK4d72TuX4^AhpP-aAH~^=j{;+e;P9&!*oh z7TYrHW-C0>ddq1=5-lDaaz_TBep zX19#bMpbb)EG&=pXTZ*>Ob`u?ODyAXcjR+E&WG*@<`%dGJF}*Xo^Z!qQz7Q!uWd_? z9V6`RWkc_VkAMFexq`QSm)7~nn0B+OqpT&U{e2|Pw}B-WE257e*Gd}RLZ*Rh^5ht9 zZ_l0iVEL_&G=zo3>o*ZRBA)kit@!r|n3IY2PPv392z#N&%tt6%oC1&9;g{#5270s) z_TQ-JGU;A>l=$2n;K`mo+d2=JfL5wt2q?&FCW9!I8OmGXuXQ*+q zy;%nZgt<@-@irMll<@meCRzdkG54S49f39NXF#L{yeRq+uq?0Q}(`gsv#8 z@=6*N!Id#;>|niYVVav0wlgW&_PsQ0eNurNNO`v^I5{Wv2S{ znx7YXdEs#eSv-sd1`S3fgjF! z&2?WxeEjTzCeT*0KH=A1a-z)S*-j9jUmjAPzOu`ATB}5^ zumOA=^*H?Y{MdX`PEOmNy1tT~8dMk|eIJ3brrKYshb0KLu9J8*cN@CUDm^jUpfeo( zcuRBYGN%8LLFraTFw(j>V18@}3|l~;&FTzuWOe?9t_AT}3&B>`BHlYdcV<^3aC49sv1Y?T|?Z)^WK2qGd@7H%lHUQ_9uAKZe zWO|3-TfX;UeGURq&&q*S6@^0DC_r5P(c#81p}snK;g5@=Dm1IYL3dNDJfuczD=6r} zZ2kJ8APDOA(a)_ze&){6><0J6wYYS`R0UO1gp=G;RMvc%+&yp0DDELvU2a4*+eo;9 z$}wJhcSunKs{CANj`gr3;KE^95y_a%a<$Wy%ZE*(%IYB}nnhOu=lD!T=dBvN^S6B& zL0PbbKTJ47TeOy{yEh1NHb*2HdH5Qr?HAU31Hlp`R8N{8pHk<15+2<%9-a?X4i(vk z4%sl;cC~{~(su~3q#%OQ>{s)5lRZQrFL=E3zj6;u75Q}{K_J`$v6If8=Pw00ubxi0 z?g9$})3Md8;B_*cUjW#KCWMS((G+yc2bB5LWyW5-@q1`Dd{cLKP{zRLPlZb%DVzkv{x|* z&;;Q}Is7n8=Hp~IwwF%y@^?%+T)mqm2zdDzX4}wDpQDf6v6cn8qdm~pT|9`^uP#b6 z4o_h3+wG}24aiT)YZq}KaBsJfXXL+MX@1s^=`Y%tf%y2I?%*BEy@C@|Tga~d_+<&P zY{7(LY?XI#!xwnz%BZ)bW5CIIo!B3}Ta6wjG(;JSt1;BK;%{Wr{6M(!4$-B&1+z;RJfOM+(`|ODrdUV%)0}TP&OZYTP;eegrFuTEjGgMBtKl;WmXF4WCUf&P( zCSXzBA>qO3ajMLsH^cl~KWUcTNdL}nuUDc@UZy?zSt-z=D~*!xcMEqYSKo=6q>Ym3d7rqWNd2r ztd5oJYHIyF3c}&Q=mX~RZvB(gI{$oOwEzMXtmUe zA$+A_y)z8b!8{pQSLw~AqAIjA(Gbe(OVaHATBM2MB&r-~8p~AgUt(E-)FX-I!lKke z`Glp}$)BD;{79_A>6FLu!4v-{TmNJ{Xn{ZNhY7758V>V%05z`8yJi{=2cT4v$Nald z1kDukLQCR$uaD*j-*DP-mC)bb5Bj7~8>PP!@ud?>eCMrAmvK$>!BD7J#q*@fYZMJ$ z@0Z{9p(%-hl6CSu11ujiY??4s`m&VWe`i8 z$1}K*&Opx}$j`X2RhSeKVR@TVS9#TNyymBp-m}G9Dt=TJ{rH?vjM8lWz|vUZCEc7& z5pU~nNhNb6(;ZusMjiQmihV?2k93T1j*mS>&Ef6{_k6}!xR|&~2}fn7%f&XY-psfo z$wbkrsLtr(6GI6fbUKTx2Wk!9knL)4woYQs7D+WC8qN={=yb*tqD6e`)HB|C3^>0t zSshmOEbn;b{D$$Y=K=a*NX;yWQYiH$ONvk$B)G6PN)~t-u%UFJi2f`u0s*sv%&)ZS zvE-n9K2X&nT3+x&s?J$U1A5*U@J92M`9ax~W9_teg5>#M4Dp~4S%W(f4+?0r%pWjy z8zc`=-Xi}L45q@7^y1r0>utRIMr=8WfS}634AnK9p0VB0jDz*4B8<7ka$?MnCt^>L;{! zaHQfvH>jOzk0Z<0g@7_SWL(RafGiu-1;;Zgmfau^?_5HDezqxw$CFKDxYIY~eYo*6 z?ESt2E6)TCH>tmNSixwzJ!gPAWy0mSew|*=0^UCB==Z!ws-y&x%w6DeZ645IQEEr1 zPy2mSVG-g1s9%*OPH{R;Bn5hn_tQd~z((YS1^StExF<74{&@rV#f|csW8(@>f2mhz zq~Q+GjBCh-1#@i>Vzje)#LXQE4h_*r#pNtZnM&i}^BazWR#sG~F5NKk5srK3Sya@i z>m1&!hH*@JF;#*vZIiq(NBg%jxp@w9#;8<-IJJDLvZyhYK^~HeZZyeQ;wkDtEu0nB<&_Tt=evFX4yk zE1L6MZNa~Z5;iDM8^aog0JMhsyR~-`IX^-L_zDR^fD0ImL&JE-pz`QbT<1KfuYMj_ zY5UHW(RCUV=RxxAdF7KVZ;;P2ztivu+_+QwEa#)`>cZM>#37lF|JcCQ{l(Or)uqW{ z(b!7gMr?cJ3myz)a@I}1*X_>I8QXoPobMNkm=<|Ij)$C$YNQJ@f}5(um0UOdgm$hK zg|g;m@ivlizt8%9lh4IBgsw;QzP>N#r_$cOoDWsDZrwAJY8V6eb@AN|w$oA}W|FCi zuytNpy57TTQPoh-!9Gs|)lXM1c-=1%3LQxe;C_U+E9#9@7pL#VAGYTfGU$ABYAuI& zqy1Otp5@e6Gpb>3#l_nq&1Sml(XPr7PoBruPU5dh_S$H-N)pOM+VS%plf(s5pj$z2 zT0u~)Ajnn_L@Nlq6$I7_0Kffxh8d?74IvteJB(T;4O1& zp??FDQ;FW1ocn!UAlLsCYR{LRsPrlnJR6!3EWA{j3VomP4LnsygB~`jQj~M6{Rq9X zp7G$dSRJ-N{^>m&$d|sQULkn)5)T8N%i?Y9lRd;w69LL|fxeI*vhku~DVqH|*DOCj zc?soUNl`ja1n6RZbQWoX=p4QYiO_{fpakZScY2EMf5=6WL(qR4r$e*8j(C4ar`Ju> zgZCZ#r+I+r_S?1|d_a6+6^g1F3KI7FI-P7wzNYL-*~%;TE%7lcTzM8cL&u;7 zoz*ClO|GuxRlFstoE$MNCU?B{HG#q3QAE#w85l5u;oYB z@%usdQg8o>MkUu6R0$-nndv&=fN!1N^V`>sO-h*ki4BSC#*Tq}@nFM_(spb^<480l zX^09akb9kE3&?xXQ-q zaPZLQ3IsxGXkP0+X-TprY<(En%-U)ZHml>E=hQg1!gt!1a@~G9)DGIpYrsMW(d&pj z=g?miTg9dT6muI-5?bBu%Dq&^?ZahHeMpYRXI);}1X(PN=7^I;ZzQW7R`s-FM24Dh z?gi2O=kAC?sI+ydx}2GUzF?cG5=okX@mdnZ!^+K#PY`Hga9qhXig&#sY~|JUxO~fy zB~6NHO+}oYV2DgnvuTnYjrQKrPZ2NQSmbqFnr)>#IUGo35K& zQ@+k{@<%Hw1PKBtdZ)4Ip|NcnF&L(Wki`y~)mUD%At@>)%(hr|E=_ju=T0AbgGZBe#~k=y8AS^6mo1|?Kv9!4ix_09L^zXc z%=5qN=YvH#N)hAN50A@QeE6Ivy4OsoGlIZu-pC=cItXVu zoIR*9(593D~hh)zuK*nEhTr?!=hZS=sDZwfRIeW(>S37M4OP2#}j_Yyx0Mc8h=Ujcz&Vv z7sf0O2Y!?8%!We~#tP{Fd4!MUUopTI#KR}tAS*qt6pK1qxn=Sc5w;`*KP4V=d zQ#o-_9>|MI;e~s|x$c02I5MTfdGmm|KHIFU;M9dbq=b;1Nw8+f>mTo54z)ra-h&^4 z*P;s&n@%p~xLhxsqQh{+gf!U`aa}iU6D&|v0G}F>Mv$rwg{Suqnqv}`jK}54QO;j( zT)D@V_StDlc~lYs3$*iRB}pzeItpkXg7Ml65SR0uK-nH5aY8)hKQhnmDWK1+q6LJ* zcYMJd9v1(>Nwn`t#$kMh0m;?5RKd#M+usjSNAU1b=xb8e!8nA9J(k|p!k2wevrJA( zjgBxYWjBqjnlzPjJYg5e6lVr!z|kx+K?*uZxg4-8ZkJWuc@t`M%^A+B4C_PyOh*xd zL@X(2z$={}C)hD9AgL@Xa*4@}Fkw^?!Z7g3d8Js*02}lVgD3?U zab-aalVj!GMfN_G17F&|0=Yl47@{YYI<%vb_ySh<+-xU(ep^Z2E#wk;?+bcTHT9CQW`F4r1UDUrL{_%~2LwZ@ zmWpd+8`c(nzc2VL$LYORONJec`?EIW8V=;i{nsH`nv6*Wx~+GDhQW$oV;| zhWpBo0Hn{^mqhf2>0!5ZhhJe1h7S5QAS!g6TD#ur76N2^Z0(`rbB`%QdSrADk*cq0+8x?I_!YR#OT{)Q6Nwmee z6bG$;qa|0z^L>qFhE-!R-L64{fF5PuVYH}E5cTtvl)Z2QKC?Kp(!|Z&cp3v57#9vN zQnp#T!90^@qcUa~cM+6FeIiawjU3GA6^=;^l6|va93%RLFxiJN{PO(~-7sSiZgIqD z;k0(5gk`8058V?UI^Lq8SJ)7gT<8z!L^!rO)A``+I=6_#!er38O0DphVF#$U%&Ccc zm&$TRKvGaIc3xpixH&&1y?x+({NAdm?ju`7CWLr-jv>MnLY#fy$g>=~D*i0nwL9G* z;)hwvMd#rH&(L`b&${KGG{Vu=g8Zh6{lUD<0~I0*TX*&D&$?M}+I*Z49-HCKR==vx zm7m-BOk7OgNVNO4)(H4*Fv$2m_$kUj!}NQGB9VQS*!{OgH%naYrD7ZGyH4h`)$P}WG1u!Cda4+cpA|Ml8HNcaG<@Rv4D zO9Is`YBisQzQbV{O!nr_)zc`3%mnYQzh`Jd75Z3J*v<7lxB8kiA6agor@TcSkWmD2 z$*zmO_%NygV)f>m5`^9aTZoSm0Cj~pYE{&ZDcy5u&>qQ7ux$ZEE>!AHl( zCC`_%HGwWuVnYPO%@?i^r=eza=uXT)yzt6MT@{rbKC2Kgz6l$gBi%(k_kRk4-cUg@ zJRJKlL11yIKI#zQ?o8i%O}i`_7+k|khYZ5kN}mHO+LCIw;;mbPC{b2asAgN{bTPGZ@zX-$4^42W>8M`2PY0r}eA4&pxQ738FehA|CDGmh0BMx3 zx`WqXI+-{-TiBZYm+GKZYsG1v6WO=Dow&f|r1#a!3zPxm@K)AmBM25T|Rg&h9z_{t?p#8vol-5?# zYWL(4c)^8~iDMWmN;FdR#>hO3KdUd#HoxA^DlA^kIOQPU7-csfHU&Fyk#EMkv1u(z>#BHez}!NEaObF(&XX6i*xW%1-RgX;VBYT^gMCY*x9 z$HT+y^yhDB#$UaGDHmE+W}!<5^|s7Vdwo)QFO9bcdA zcV%`o2Fj6E%{->>rtm*HDp{p1{m_r#)H?)h_l7P?5TtAgbz;p%Rl98k`GL1-5G-GN zZ0zqBCtnVr&Kki`^=393JA!#CbRj4KKG!BH!JLpMr(bfR-J72kphPG% zA^;)Qtc>vAGTtBviP*%jcnB;m6tjnG8!c$?GaL^t&ROZ`>FA*+eT4>H)SE?Re_+di zEhM0ox853e{m|ElT?s?`DNfcEI;xWr%ik^n_9YryPU?qm4V}`L4?(O3+Oo1(VyFW? zie{7W(7p1W&#`@?Eg49j^3+B%Z_x$ol7e99#R#h<=V@smyXR7h|RMNOc7rwDVrG)Q}q)cYbT3xnk8iyC*;UOSs+Xw`Q;O>+Q8 z(1#rDZh#6xIzq+u1pmSm8D0b(nY!U)en)NggP|-n1z*s6*8zq7r)AR`%_wv1Fw{3b zrlTJz16WZC{paBP8^iE#=(d|^XGj#mru7n{=^1=Fz=MhCPTz-*)WHjDP^#Hgc$p^R z=Xchv+jL@0zI7~CpL#ph%?sQkG&}<&0iOGfU{)XCtzsYj zT?FO?+k^~UzbIBZO_pcI1}9#1Q(8I8^l8b2STcyF-^X36OECzC^7!NR*A+Za7*OiV zCoNww)niiAj~Nwd6%@CW_Pyz_K?n`!=vtl#Gc*c}J?Qb%BF3e6zE`rouTNIgvDBm7 zprFIrFV8miIj_sfQ~nygw;Vj;e&t)cC@a9P{#eA z=+p8D`89g20SThsQ+{{_`A6 z{Cw$T2r}N+yW`Ad@AkJ-y=dS@^a^c}T(7QlDh- zxP(W_$Q8I~zTmub;j7I1L8xdgH0Rp>*hwiej*g#ht-YQVMxsl|j!qIE239eSWQdkW zdF_gk{FG{t9kA}Ap{>|_nEjP|jQ%s&X0)kv_KsUu@(1VC-V@vJ=wAD%n<1Bwr}*gc zC4L)Qj?-!j_=vf|m{dOL=KF1U_D3WlW)ur5R5-+7-(Rrij!UwVn_G762Yy^P3^4cB z<&K?lXi{sZ^SikcoPLa#?$7whm>_D=ZN@(=7T){mA)QjcTz**1-?xJ&xmxu0w8jQ? zQuK@8y3%RG6rvHOH^rL`U4o+J5w~0aZKrI+3_Ba5Jqg>y8(DH$=R?-1z>(BJCUZv2 za2un9BlRN4nvs^6@NM<{0ysKDW?sd#Mt>TOuZXe1MutoY>li;usx*^&T!n3aW>gf0 zPS#1jeC-^>4_7+z-DN#Q(i|tisJU{gY^Cuez@SrAxotqnN&5Lr&(OANz_3(4gsrA3 z=7($#{dlGRl3B9zR9|rg@#l+2M{g^1z^fJz@+|-W|9bH-va@ymr9%C6{Z(JFJ0M5* zUC{@6OfKuBn10qOADGU!n95aYYT5%`OM~&4WAk=6oUfet8wE@?ZP9x<7>?fHzulqm zeRMV#tuvdqCsV&$-)0|6CJlGgEI%(FYsb2|E4XrtDK6#&lBwoeCD%YHO@6m~V{I`g z)HKLLClidwk=KpLl1G+j`2|nYB$EC~uPeM#B2M;ZHQDB8XMQ}s>-QdpJsvOn;e6bi zBI8h~g5FE%ym%yWbP#ws2VLFc_wc~g^Apv!>N+}<{fFm#{bfqsoSv>Oi1SGUM%aeB zsqZt1|!uCl7=DbKdNc5xIxJiwWa#h)2yTpF1`+bc{(C+$B`_>O{Xw?!pk7)(~#KOit(|*yo+6!Z?i*0)Dl znh>sh&S}OkLxKD50rt#34!MoaSM)5i!LCh4W05!%)&zmd(e}LQtyAHLv>=g=LvF5E ze69ROG~k-WmZ(VTmGBcZsNg4tMKY`NX!jh`_qb)19F+-dNg_)0=|mJSZbD}#N#&hz zk%|2e8)7*`y|hQ#cc+g~T$*dWBnbXf@)NbI^!hPw{#kz5=$O`^u~9bitJ)d2okPO7Ps|6JBV(#9IqH75QoPr3I%}q@wF76vDowrmkKPAG%aE z_2ACp);B8w;ExB7^us^a1~-aS=HC_0Vc1RxZ?V{Lv1smYkR>qIkYej#udpOa#8)Ue zd~|@0Jme$1xvG>8z!HmD>-kybd&yzb^}M(0MBK1*Ww@P0$x+tPC+vdxt)vv0aTjPW zv~j+^Htq*Efy1-eUVTPwGG;_sJ_YVqu6Dj~YO=b-e^Tq3*{um^tnLj_qtNnt`vV!A zHSBH5U5NI}U+TP?8}mu1*P=P_b-Mnl^Zut+b~H8}`8;A9$cP+t!W(QdIw!~g1?5ON z*l3y2!4{$c#c-a2y4)81SxqUoct7LE#y4@6mFSwUM?k#(h^oR)6;>lEvO!7n+C3WX zX8Ojw1@8H|IvTkIybS6lH(P2h{ls884g~A5>TF8)lnY*k7UIrnP6tVZ-kN9_ zSb`{Fi>pmE%tgF()Lcun#$ zJuHbAN?e^;N9%nCty6*7yauN<(PMMVpAho5^j2Fdj&%Z8yg}xk$3~tmQ$1%ZBnbwo z%*P7*%{(42JJ0lEFF5PvHLjx8f}=TR_pv)Q=Y*;f<$o|6;9mqTxUb<7v9mR`FmrMI zFY&z-GlP@!tGdO>5a`J8hu=RWysxJMz<+(b+AsP3U;ThaMkdxKuP}Cw3`Q=Fj{nV; z5dX8p`Omtyx3hP#e--?@{7?7)>i0{R^VjYzY=CAaP7J~p&Ne`Mr~k$I?|!qhot?Ek z(ALEIfAPcnn@;T=?aW?T>RU!6k56fQ{>A%4UN&X4!e`x5n zWcVw@Uzeu8A*@ONyionC=U?lR-=0O(f2vac>iAcd{Ozbh|7Xtp?fI`s`D^n0wm^n| zP3(WBk3Z7w?+N5LPV?X3{2My?&j$zoy4B#Xv+keC<&VMr>yP|%hH(E4&cBe&zX$ts z#N7S{?4QZ!-{btEpWjygH#mPLqkoU|i;jNV-rpeoCa3=tg^=lAgZ-PV{! xStorage + = comphelper::OStorageHelper::GetStorageOfFormatFromURL( + ZIP_STORAGE_FORMAT_STRING, aTempFile.GetURL(), embed::ElementModes::READWRITE); + CPPUNIT_ASSERT(xStorage.is()); + aManager.mxStore = xStorage; + aManager.maSignatureHelper.SetStorage(xStorage, "1.2"); + aManager.read(/*bUseTempStream=*/false); + + // Create a new signature. + uno::Reference xCertificate + = getCertificate(aManager, svl::crypto::SignatureMethodAlgorithm::RSA); + if (!xCertificate.is()) + return; + sal_Int32 nSecurityId; + aManager.add(xCertificate, mxSecurityContext, /*rDescription=*/OUString(), nSecurityId, + /*bAdESCompliant=*/true); + + // Write to storage. + aManager.read(/*bUseTempStream=*/true); + aManager.write(/*bXAdESCompliantIfODF=*/true); + uno::Reference xTransactedObject(xStorage, uno::UNO_QUERY); + xTransactedObject->commit(); + + // Parse the resulting XML. + uno::Reference xMetaInf + = xStorage->openStorageElement("META-INF", embed::ElementModes::READ); + uno::Reference xInputStream( + xMetaInf->openStreamElement("documentsignatures.xml", embed::ElementModes::READ), + uno::UNO_QUERY); + std::shared_ptr pStream(utl::UcbStreamHelper::CreateStream(xInputStream, true)); + xmlDocPtr pXmlDoc = parseXmlStream(pStream.get()); + + // Without the accompanying fix in place, this test would have failed with "unexpected 'Type' + // attribute", i.e. the signature without such an attribute was not preserved correctly. + assertXPathNoAttribute(pXmlDoc, + "/odfds:document-signatures/dsig:Signature[1]/dsig:SignedInfo/" + "dsig:Reference[@URI='#idSignedProperties']", + "Type"); + + // New signature always has the Type attribute. + assertXPath(pXmlDoc, + "/odfds:document-signatures/dsig:Signature[2]/dsig:SignedInfo/" + "dsig:Reference[@URI='#idSignedProperties']", + "Type", "http://uri.etsi.org/01903#SignedProperties"); +} + /// Creates a XAdES signature from scratch. CPPUNIT_TEST_FIXTURE(SigningTest, testXAdES) { diff --git a/xmlsecurity/source/helper/ooxmlsecparser.cxx b/xmlsecurity/source/helper/ooxmlsecparser.cxx index 6844162c0151..457ef66bf24b 100644 --- a/xmlsecurity/source/helper/ooxmlsecparser.cxx +++ b/xmlsecurity/source/helper/ooxmlsecparser.cxx @@ -72,7 +72,7 @@ void SAL_CALL OOXMLSecParser::startElement(const OUString& rName, const uno::Ref { OUString aURI = xAttribs->getValueByName("URI"); if (aURI.startsWith("#")) - m_pXSecController->addReference(aURI.copy(1), xml::crypto::DigestID::SHA1); + m_pXSecController->addReference(aURI.copy(1), xml::crypto::DigestID::SHA1, OUString()); else { m_aReferenceURI = aURI; diff --git a/xmlsecurity/source/helper/xsecctl.cxx b/xmlsecurity/source/helper/xsecctl.cxx index ed7ccfba7fd2..56d354572a41 100644 --- a/xmlsecurity/source/helper/xsecctl.cxx +++ b/xmlsecurity/source/helper/xsecctl.cxx @@ -662,12 +662,12 @@ void XSecController::exportSignature( "URI", "#" + refInfor.ouURI); - if (bXAdESCompliantIfODF && refInfor.ouURI == "idSignedProperties") + if (bXAdESCompliantIfODF && refInfor.ouURI == "idSignedProperties" && !refInfor.ouType.isEmpty()) { // The reference which points to the SignedProperties // shall have this specific type. pAttributeList->AddAttribute("Type", - "http://uri.etsi.org/01903#SignedProperties"); + refInfor.ouType); } } diff --git a/xmlsecurity/source/helper/xsecparser.cxx b/xmlsecurity/source/helper/xsecparser.cxx index d24f5f5c5ec8..532ba07a0298 100644 --- a/xmlsecurity/source/helper/xsecparser.cxx +++ b/xmlsecurity/source/helper/xsecparser.cxx @@ -129,12 +129,14 @@ void SAL_CALL XSecParser::startElement( { OUString ouUri = xAttribs->getValueByName("URI"); SAL_WARN_IF( ouUri.isEmpty(), "xmlsecurity.helper", "URI is empty" ); + // Remember the type of this reference. + OUString ouType = xAttribs->getValueByName("Type"); if (ouUri.startsWith("#")) { /* * remove the first character '#' from the attribute value */ - m_pXSecController->addReference( ouUri.copy(1), m_nReferenceDigestID ); + m_pXSecController->addReference( ouUri.copy(1), m_nReferenceDigestID, ouType ); } else { diff --git a/xmlsecurity/source/helper/xsecsign.cxx b/xmlsecurity/source/helper/xsecsign.cxx index da1122ccc3ec..d8089b1773b3 100644 --- a/xmlsecurity/source/helper/xsecsign.cxx +++ b/xmlsecurity/source/helper/xsecsign.cxx @@ -138,12 +138,13 @@ cssu::Reference< cssxc::sax::XReferenceResolvedListener > XSecController::prepar { internalSignatureInfor.signatureInfor.ouSignatureId = createId(); internalSignatureInfor.signatureInfor.ouPropertyId = createId(); - internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, internalSignatureInfor.signatureInfor.ouPropertyId, -1 ); + internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, internalSignatureInfor.signatureInfor.ouPropertyId, -1, OUString() ); size++; if (bXAdESCompliantIfODF) { - internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, "idSignedProperties", -1); + // We write a new reference, so it's possible to use the correct type URI. + internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, "idSignedProperties", -1, "http://uri.etsi.org/01903#SignedProperties"); size++; } @@ -151,17 +152,17 @@ cssu::Reference< cssxc::sax::XReferenceResolvedListener > XSecController::prepar { // Only mention the hash of the description in the signature if it's non-empty. internalSignatureInfor.signatureInfor.ouDescriptionPropertyId = createId(); - internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, internalSignatureInfor.signatureInfor.ouDescriptionPropertyId, -1); + internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, internalSignatureInfor.signatureInfor.ouDescriptionPropertyId, -1, OUString()); size++; } } else { - internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, "idPackageObject", -1); + internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, "idPackageObject", -1, OUString()); size++; - internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, "idOfficeObject", -1); + internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, "idOfficeObject", -1, OUString()); size++; - internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, "idSignedProperties", -1); + internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, "idSignedProperties", -1, OUString()); size++; } @@ -189,7 +190,7 @@ void XSecController::signAStream( sal_Int32 securityId, const OUString& uri, boo if (index == -1) { InternalSignatureInformation isi(securityId, nullptr); - isi.addReference(type, digestID, uri, -1); + isi.addReference(type, digestID, uri, -1, OUString()); m_vInternalSignatureInformations.push_back( isi ); } else @@ -197,7 +198,7 @@ void XSecController::signAStream( sal_Int32 securityId, const OUString& uri, boo // use sha512 for gpg signing unconditionally if (!m_vInternalSignatureInformations[index].signatureInfor.ouGpgCertificate.isEmpty()) digestID = cssxc::DigestID::SHA512; - m_vInternalSignatureInformations[index].addReference(type, digestID, uri, -1); + m_vInternalSignatureInformations[index].addReference(type, digestID, uri, -1, OUString()); } } diff --git a/xmlsecurity/source/helper/xsecverify.cxx b/xmlsecurity/source/helper/xsecverify.cxx index 97204755715d..a3c8cd9776c5 100644 --- a/xmlsecurity/source/helper/xsecverify.cxx +++ b/xmlsecurity/source/helper/xsecverify.cxx @@ -148,7 +148,7 @@ void XSecController::switchGpgSignature() #endif } -void XSecController::addReference( const OUString& ouUri, sal_Int32 nDigestID ) +void XSecController::addReference( const OUString& ouUri, sal_Int32 nDigestID, const OUString& ouType ) { if (m_vInternalSignatureInformations.empty()) { @@ -156,7 +156,7 @@ void XSecController::addReference( const OUString& ouUri, sal_Int32 nDigestID ) return; } InternalSignatureInformation &isi = m_vInternalSignatureInformations.back(); - isi.addReference(SignatureReferenceType::SAMEDOCUMENT, nDigestID, ouUri, -1 ); + isi.addReference(SignatureReferenceType::SAMEDOCUMENT, nDigestID, ouUri, -1, ouType ); } void XSecController::addStreamReference( @@ -189,7 +189,7 @@ void XSecController::addStreamReference( } } - isi.addReference(type, nDigestID, ouUri, -1); + isi.addReference(type, nDigestID, ouUri, -1, OUString()); } void XSecController::setReferenceCount() const