mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

only use X509Data

Browse Source 
Change-Id: I52e6588f5fac04bb26d77c1f3af470db73e41f72
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127193
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
This commit is contained in:
Caolán McNamara
2021-12-20 17:05:44 +00:00
committed by Miklos Vajna
parent 6485187c53
commit be446d81e0
3 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
xmlsecurity/inc/xmlsec-wrapper.h
View File

@@ -42,6 +42,10 @@
#include <xmlsec/nss/app.h> #include <xmlsec/nss/app.h>
#include <xmlsec/nss/crypto.h> #include <xmlsec/nss/crypto.h>
#include <xmlsec/nss/pkikeys.h> #include <xmlsec/nss/pkikeys.h>
#include <xmlsec/nss/x509.h>
#endif
#ifdef XMLSEC_CRYPTO_MSCRYPTO
#include <xmlsec/mscng/x509.h>
#endif #endif
/* vim:set shiftwidth=4 softtabstop=4 expandtab: */ /* vim:set shiftwidth=4 softtabstop=4 expandtab: */

4
xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
View File

@@ -233,6 +233,10 @@ SAL_CALL XMLSignature_MSCryptImpl::validate(
// We do certificate verification ourselves. // We do certificate verification ourselves.
pDsigCtx->keyInfoReadCtx.flags |= XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS; pDsigCtx->keyInfoReadCtx.flags |= XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS;
// limit possible key data to valid X509 certificates only, no KeyValues
if (xmlSecPtrListAdd(&(pDsigCtx->keyInfoReadCtx.enabledKeyData), BAD_CAST xmlSecMSCngKeyDataX509GetKlass()) < 0)
throw RuntimeException("failed to limit allowed key data");
//Verify signature //Verify signature
//The documentation says that the signature is only valid if the return value is 0 (that is, not < 0) //The documentation says that the signature is only valid if the return value is 0 (that is, not < 0)
//AND pDsigCtx->status == xmlSecDSigStatusSucceeded. That is, we must not make any assumptions, if //AND pDsigCtx->status == xmlSecDSigStatusSucceeded. That is, we must not make any assumptions, if

4
xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
View File

@@ -239,6 +239,10 @@ SAL_CALL XMLSignature_NssImpl::validate(
// We do certificate verification ourselves. // We do certificate verification ourselves.
pDsigCtx->keyInfoReadCtx.flags |= XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS; pDsigCtx->keyInfoReadCtx.flags |= XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS;
// limit possible key data to valid X509 certificates only, no KeyValues
if (xmlSecPtrListAdd(&(pDsigCtx->keyInfoReadCtx.enabledKeyData), BAD_CAST xmlSecNssKeyDataX509GetKlass()) < 0)
throw RuntimeException("failed to limit allowed key data");
//Verify signature //Verify signature
int rs = xmlSecDSigCtxVerify( pDsigCtx.get() , pNode ); int rs = xmlSecDSigCtxVerify( pDsigCtx.get() , pNode );