Package eu.europa.esig.dss.xades
Class DSSXMLUtils
java.lang.Object
eu.europa.esig.dss.xades.DSSXMLUtils
-
Field Summary
Modifier and TypeFieldDescriptionstatic final DSSNamespace
SAML namespace definitionstatic final String
The SPDocDigestAsInSpecification transform algorithm URI for a custom SignaturePolicy processingstatic final int
Value used to pretty print xades signature -
Method Summary
Modifier and TypeMethodDescriptionstatic Node
alignChildrenIndents
(Node parentNode) Aligns indents for all children of the given nodestatic byte[]
applyTransforms
(DSSDocument document, List<DSSTransform> transforms) Applies transforms on document content and returns the byte array to be used for a digest computation NOTE: returns the original document binaries, if the list oftransforms
is empty.static byte[]
applyTransforms
(Node node, List<DSSTransform> transforms) Applies transforms on the node and returns the byte array to be used for a digest computation NOTE: returns the original node binaries, if the list oftransforms
is emptystatic boolean
containsTransforms
(Element referenceElement) This method checks if the reference element contain any transformationstatic XAdESSignature
createCounterSignature
(Element counterSignatureElement, XAdESSignature masterSignature) Creates and returns a counter signature found in thecounterSignatureElement
static Element
ensureNamespacesDefined
(Document document, String elementId, String xpathString) This method produces a copy of the document and returns an element by the definedxpathString
.static List
<org.apache.xml.security.signature.Reference> extractReferences
(org.apache.xml.security.signature.Manifest manifest) Extracts a list ofReference
s from the givenManifest
object NOTE: can be used also for aSignedInfo
elementstatic NodeList
getAllEncapsulatedTimestamps
(Node documentNode) Returns a NodeList of all "xades:EncapsulatedTimeStamp" elements found in thedocumentNode
static NodeList
getAllSignaturesExceptCounterSignatures
(Node documentNode) Returns a NodeList of all "ds:Signature" elements found in thedocumentNode
static String
getAttribute
(Node node, String attributeName) Returns attribute value for the given attribute name if exist, otherwise returns NULLstatic Digest
getDigestAndValue
(Element element) This method extracts the Digest algorithm and value from an element of type DigestAlgAndValueTypestatic String
getDocumentName
(org.apache.xml.security.signature.Reference reference) This method returns a name of the linked document to the reference (when applicable)static Document
getDocWithIndentedSignature
(Document documentDom, String signatureId, List<String> noIndentObjectIds) Pretty prints a signature in the given documentstatic String
getIDIdentifier
(Node node) If this method finds an attribute with the name ID (case-insensitive) then it is returned.static Node
getIndentedNode
(Node documentDom, Node xmlNode) Returns an indented xmlNodestatic PublicKey
getKeyInfoSigningCertificatePublicKey
(Element signatureElement) Extracts signing certificate's public key from KeyInfo element of a given signature if present NOTE: can return null (the value is optional)static Element
getManifestById
(Element signatureElement, String id) Gets ds:Manifest by its Id from the ds:Signature elementstatic Element
getObjectById
(Element signatureElement, String id) Gets ds:Object by its Id from the ds:Signature elementstatic Digest
getReferenceDigest
(org.apache.xml.security.signature.Reference reference) Returns theDigest
extracted from the providedreference
static DigestAlgorithm
Returns params.referenceDigestAlgorithm if exists, params.digestAlgorithm otherwisestatic Set
<DigestAlgorithm> getReferenceDigestAlgos
(Element referenceContainer) Returns a list ofDigestAlgorithm
for all references containing inside the providedreferenceContainer
static String
getReferenceId
(org.apache.xml.security.signature.Reference reference) This method retrieves an Id attribute value of the given reference, when applicable NOTE: Method is used due to Apache Santuario Signature returning an empty string instead of null result.static NodeList
getReferenceNodeList
(Node signatureElement) Returns a NodeList of "ds:Reference" elementsstatic byte[]
getReferenceOriginalContentBytes
(org.apache.xml.security.signature.Reference reference) Returns bytes of the original referenced datastatic ReferenceOutputType
getReferenceOutputType
(DSSReference reference) Returns the expected dereferencing output for the providedDSSReference
static ReferenceOutputType
getReferenceOutputType
(org.apache.xml.security.signature.Reference reference) Returns the expected dereferencing output for the providedReference
getReferenceTypes
(Element referenceContainer) Returns a list of reference typesstatic String
getReferenceURI
(org.apache.xml.security.signature.Reference reference) This method retrieves a URI attribute value of the given reference, when applicable NOTE: Method is used due to Apache Santuario Signature returning an empty string instead of null result.static void
incorporateDigestMethod
(Element parentElement, DigestAlgorithm digestAlgorithm, DSSNamespace namespace) This method creates the ds:DigestMethod DOM objectstatic void
incorporateDigestValue
(Element parentDom, String base64EncodedDigestBytes, DSSNamespace namespace) This method creates the ds:DigestValue DOM object.static void
incorporateTransforms
(Element parentElement, List<DSSTransform> transforms, DSSNamespace namespace) Incorporates a ds:Transforms element into the given parentelement
static Node
indentAndExtend
(Document document, Node newNode, Node oldNode) Extends the given oldNode by appending new indented childs from the given newNodestatic Node
indentAndReplace
(Document document, Node node) Indents the given node and replaces it with a new one on the documentstatic org.apache.xml.security.signature.Manifest
initManifest
(Element manifestElement) Initializes a Manifest object from the provided ds:Manifest elementstatic void
initManifestDetachedContent
(org.apache.xml.security.signature.Manifest manifest, List<DSSDocument> detachedContents) Initializes detached content within the givenmanifest
static org.apache.xml.security.signature.Manifest
initManifestWithDetachedContent
(Element manifestElement, List<DSSDocument> detachedContents) Initializes a Manifest object from the provided ds:Manifest element with a provideddetachedContents
static boolean
isAbleToDeReferenceContent
(org.apache.xml.security.signature.Reference reference) Checks if the original reference document content can be obtained (de-referenced)static boolean
isCounterSignature
(org.apache.xml.security.signature.Reference reference, XAdESPath xadesPaths) Determines if the givenreference
refers to CounterSignature elementstatic boolean
isCounterSignatureReferenceType
(String referenceType) Checks if the givenreferenceType
is an etsi Countersignature typestatic boolean
This method is used to detect duplicate id valuesstatic boolean
isKeyInfoReference
(org.apache.xml.security.signature.Reference reference, Element signature) Checks if the given reference is linked to a KeyInfo elementstatic boolean
isManifestReferenceType
(String referenceType) Checks if the givenreferenceType
is an xmldsig Manifest typestatic boolean
isObjectReferenceType
(String referenceType) Checks if the givenreferenceType
is an xmldsig Object typestatic boolean
isReferencedContentAmbiguous
(Document document, String uri) Checks if the reference with theuri
occurs multiple times in thedocument
static boolean
isSameDocumentReference
(String referenceUri) XMLDSIG 4.4.3.2 The Reference Processing Model A 'same-document' reference is defined as a URI-Reference that consists of a hash sign ('#') followed by a fragment or alternatively consists of an empty URIstatic boolean
isSignaturePropertiesReference
(org.apache.xml.security.signature.Reference reference, Element signature) Checks if the given reference is linked to a SignatureProperties element or one of its SignatureProperty childrenstatic boolean
isSignedProperties
(org.apache.xml.security.signature.Reference reference, XAdESPath xadesPaths) Determines if the givenreference
refers to SignedProperties elementstatic void
recursiveIdBrowse
(Element element) An ID attribute can only be dereferenced if it is declared in the validation context.static boolean
registerTransform
(String transformURI) This method allows to register a transformation.static boolean
registerTransformWithNodeSetOutput
(String transformURI) This method allows to register a transformation resulting to a node-set output.static void
Registers the XAdES namespacesstatic void
setIDIdentifier
(Element childElement) If this method finds an attribute with names ID (case-insensitive) then declares it to be a user-determined ID attribute.validateAgainstXSD
(XSDAbstractUtils xsdUtils, Source source) This method allows to validate an XML against the XAdES XSD schema.
-
Field Details
-
TRANSFORMER_INDENT_NUMBER
public static final int TRANSFORMER_INDENT_NUMBERValue used to pretty print xades signature- See Also:
-
SP_DOC_DIGEST_AS_IN_SPECIFICATION_ALGORITHM_URI
The SPDocDigestAsInSpecification transform algorithm URI for a custom SignaturePolicy processing- See Also:
-
SAML_NAMESPACE
SAML namespace definition
-
-
Method Details
-
registerXAdESNamespaces
public static void registerXAdESNamespaces()Registers the XAdES namespaces -
registerTransform
This method allows to register a transformation.- Parameters:
transformURI
- the URI of transform- Returns:
- true if this set did not already contain the specified element
-
registerTransformWithNodeSetOutput
This method allows to register a transformation resulting to a node-set output. See XMLDSIG for more information- Parameters:
transformURI
- the URI of transform- Returns:
- true if this set did not already contain the specified element
-
indentAndReplace
-
indentAndExtend
Extends the given oldNode by appending new indented childs from the given newNode -
getDocWithIndentedSignature
-
getIndentedNode
-
alignChildrenIndents
-
recursiveIdBrowse
An ID attribute can only be dereferenced if it is declared in the validation context. This behaviour is caused by the fact that the attribute does not have attached type of information. Another solution is to parse the XML against some DTD or XML schema. This process adds the necessary type of information to each ID attribute.- Parameters:
element
-Element
-
getIDIdentifier
-
getAttribute
Returns attribute value for the given attribute name if exist, otherwise returns NULL -
setIDIdentifier
-
validateAgainstXSD
This method allows to validate an XML against the XAdES XSD schema.- Parameters:
xsdUtils
- the XSD Utils class to be usedsource
-Source
XML to validate- Returns:
- an empty list if the XSD validates the XML, error messages otherwise
-
isDuplicateIdsDetected
This method is used to detect duplicate id values- Parameters:
doc
- the document to be analyzed- Returns:
- TRUE if a duplicate id is detected
-
getReferenceOriginalContentBytes
public static byte[] getReferenceOriginalContentBytes(org.apache.xml.security.signature.Reference reference) Returns bytes of the original referenced data- Parameters:
reference
-Reference
to get bytes from- Returns:
- byte array containing original data
-
getDigestAndValue
-
containsTransforms
This method checks if the reference element contain any transformation- Parameters:
referenceElement
- the DOM element with the reference- Returns:
- true if the reference contain any transform
-
isSignedProperties
public static boolean isSignedProperties(org.apache.xml.security.signature.Reference reference, XAdESPath xadesPaths) Determines if the givenreference
refers to SignedProperties element- Parameters:
reference
-Reference
to checkxadesPaths
-XAdESPath
- Returns:
- TRUE if the reference refers to the SignedProperties, FALSE otherwise
-
isCounterSignature
public static boolean isCounterSignature(org.apache.xml.security.signature.Reference reference, XAdESPath xadesPaths) Determines if the givenreference
refers to CounterSignature element- Parameters:
reference
-Reference
to checkxadesPaths
-XAdESPath
- Returns:
- TRUE if the reference refers to the CounterSignature, FALSE otherwise
-
isKeyInfoReference
public static boolean isKeyInfoReference(org.apache.xml.security.signature.Reference reference, Element signature) Checks if the given reference is linked to a KeyInfo element- Parameters:
reference
- theReference
to checksignature
- theElement
signature the given reference belongs to- Returns:
- TRUE if the reference is a KeyInfo reference, FALSE otherwise
-
isSignaturePropertiesReference
public static boolean isSignaturePropertiesReference(org.apache.xml.security.signature.Reference reference, Element signature) Checks if the given reference is linked to a SignatureProperties element or one of its SignatureProperty children- Parameters:
reference
- theReference
to checksignature
- theElement
signature the given reference belongs to- Returns:
- TRUE if the reference is a SignatureProperties reference, FALSE otherwise
-
isObjectReferenceType
-
isManifestReferenceType
-
isCounterSignatureReferenceType
-
isSameDocumentReference
XMLDSIG 4.4.3.2 The Reference Processing Model A 'same-document' reference is defined as a URI-Reference that consists of a hash sign ('#') followed by a fragment or alternatively consists of an empty URI- Parameters:
referenceUri
-String
uri of a reference to check- Returns:
- TRUE is the URI points to a same-document, FALSE otherwise
-
getObjectById
-
getManifestById
-
initManifest
public static org.apache.xml.security.signature.Manifest initManifest(Element manifestElement) throws org.apache.xml.security.exceptions.XMLSecurityException Initializes a Manifest object from the provided ds:Manifest element- Parameters:
manifestElement
-Element
ds:Manifest element- Returns:
Manifest
object- Throws:
org.apache.xml.security.exceptions.XMLSecurityException
- if en error occurs in an attempt to initialize the Manifest object
-
initManifestWithDetachedContent
public static org.apache.xml.security.signature.Manifest initManifestWithDetachedContent(Element manifestElement, List<DSSDocument> detachedContents) throws org.apache.xml.security.exceptions.XMLSecurityException Initializes a Manifest object from the provided ds:Manifest element with a provideddetachedContents
- Parameters:
manifestElement
-Element
ds:Manifest elementdetachedContents
- a list ofDSSDocument
s representing a detached content- Returns:
Manifest
object- Throws:
org.apache.xml.security.exceptions.XMLSecurityException
- if en error occurs in an attempt to initialize the Manifest object
-
initManifestDetachedContent
public static void initManifestDetachedContent(org.apache.xml.security.signature.Manifest manifest, List<DSSDocument> detachedContents) Initializes detached content within the givenmanifest
- Parameters:
manifest
-Manifest
to initialize detached content indetachedContents
- a list ofDSSDocument
s
-
getKeyInfoSigningCertificatePublicKey
Extracts signing certificate's public key from KeyInfo element of a given signature if present NOTE: can return null (the value is optional) -
createCounterSignature
public static XAdESSignature createCounterSignature(Element counterSignatureElement, XAdESSignature masterSignature) Creates and returns a counter signature found in thecounterSignatureElement
- Parameters:
counterSignatureElement
-Element
<ds:CounterSignature>
elementmasterSignature
-XAdESSignature
master signature containing the counter signature- Returns:
XAdESSignature
-
getAllSignaturesExceptCounterSignatures
-
getAllEncapsulatedTimestamps
-
getReferenceNodeList
-
getReferenceOutputType
Returns the expected dereferencing output for the providedDSSReference
- Parameters:
reference
-DSSReference
to get OutputType for- Returns:
ReferenceOutputType
-
getReferenceOutputType
public static ReferenceOutputType getReferenceOutputType(org.apache.xml.security.signature.Reference reference) throws org.apache.xml.security.exceptions.XMLSecurityException Returns the expected dereferencing output for the providedReference
- Parameters:
reference
-Reference
to get OutputType for- Returns:
ReferenceOutputType
- Throws:
org.apache.xml.security.exceptions.XMLSecurityException
- if an exception occurs
-
applyTransforms
Applies transforms on the node and returns the byte array to be used for a digest computation NOTE: returns the original node binaries, if the list oftransforms
is empty- Parameters:
node
-Node
to apply transforms ontransforms
- a list ofDSSTransform
s to execute on the node- Returns:
- a byte array, representing a content obtained after transformations
-
applyTransforms
Applies transforms on document content and returns the byte array to be used for a digest computation NOTE: returns the original document binaries, if the list oftransforms
is empty. Thedocument
shall represent an XML content.- Parameters:
document
-DSSDocument
representing an XML to apply transforms ontransforms
- a list ofDSSTransform
s to execute on the node- Returns:
- a byte array, representing a content obtained after transformations
-
getReferenceDigestAlgos
Returns a list ofDigestAlgorithm
for all references containing inside the providedreferenceContainer
- Parameters:
referenceContainer
-Element
containing the ds:Reference elements- Returns:
- a set of
DigestAlgorithm
s
-
getReferenceTypes
-
extractReferences
public static List<org.apache.xml.security.signature.Reference> extractReferences(org.apache.xml.security.signature.Manifest manifest) Extracts a list ofReference
s from the givenManifest
object NOTE: can be used also for aSignedInfo
element- Parameters:
manifest
-Manifest
- Returns:
- a list of
Reference
s
-
getReferenceDigest
-
getReferenceId
This method retrieves an Id attribute value of the given reference, when applicable NOTE: Method is used due to Apache Santuario Signature returning an empty string instead of null result.- Parameters:
reference
-Reference
to get value of Id attribute- Returns:
String
Id attribute value if available, NULL otherwise
-
getReferenceURI
This method retrieves a URI attribute value of the given reference, when applicable NOTE: Method is used due to Apache Santuario Signature returning an empty string instead of null result.- Parameters:
reference
-Reference
to get value of URI attribute- Returns:
String
URI attribute value if available, NULL otherwise
-
isAbleToDeReferenceContent
public static boolean isAbleToDeReferenceContent(org.apache.xml.security.signature.Reference reference) Checks if the original reference document content can be obtained (de-referenced)- Parameters:
reference
-Reference
to check- Returns:
- TRUE if the de-referencing is succeeding, FALSE otherwise
-
isReferencedContentAmbiguous
Checks if the reference with theuri
occurs multiple times in thedocument
-
incorporateTransforms
public static void incorporateTransforms(Element parentElement, List<DSSTransform> transforms, DSSNamespace namespace) Incorporates a ds:Transforms element into the given parentelement
- Parameters:
parentElement
-Element
to incorporate ds:Transforms intotransforms
- a list ofDSSTransform
s to be incorporatednamespace
-DSSNamespace
to use
-
incorporateDigestMethod
public static void incorporateDigestMethod(Element parentElement, DigestAlgorithm digestAlgorithm, DSSNamespace namespace) This method creates the ds:DigestMethod DOM object<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
- Parameters:
parentElement
-Element
the parent elementdigestAlgorithm
-DigestAlgorithm
the digest algorithmnamespace
-DSSNamespace
to use
-
incorporateDigestValue
public static void incorporateDigestValue(Element parentDom, String base64EncodedDigestBytes, DSSNamespace namespace) This method creates the ds:DigestValue DOM object.<ds:DigestValue>fj8SJujSXU4fi342bdtiKVbglA0=</ds:DigestValue>
- Parameters:
parentDom
-Element
the parent elementbase64EncodedDigestBytes
-String
representing a base64-encoded Digest valuenamespace
-DSSNamespace
-
getReferenceDigestAlgorithmOrDefault
Returns params.referenceDigestAlgorithm if exists, params.digestAlgorithm otherwise- Parameters:
params
-XAdESSignatureParameters
- Returns:
DigestAlgorithm
-
ensureNamespacesDefined
public static Element ensureNamespacesDefined(Document document, String elementId, String xpathString) This method produces a copy of the document and returns an element by the definedxpathString
. This method can be used as a workaround for canonicalization, as namespaces are not added to canonicalizer for new created elements. The issue was reported on: SANTUARIO-139 -
getDocumentName
-