commit be446d81e07b5499152efeca6ca23034e51ea5ff
author Caolán McNamara <caolanm@redhat.com> Mon Dec 20 17:05:44 2021 +0000
committer Miklos Vajna <vmiklos@collabora.com> Tue Dec 21 08:37:45 2021 +0100
tree 1149a48169fc7d0221dc3b2f7ec45e8a90305bef
parent 6485187c5351f9356a3f27bae86bd0460b6bd3c8

only use X509Data

Change-Id: I52e6588f5fac04bb26d77c1f3af470db73e41f72
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127193
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>

xmlsecurity/inc/xmlsec-wrapper.h

diff --git a/xmlsecurity/inc/xmlsec-wrapper.h b/xmlsecurity/inc/xmlsec-wrapper.h
index e4048de..cc14937 100644
--- a/xmlsecurity/inc/xmlsec-wrapper.h
+++ b/xmlsecurity/inc/xmlsec-wrapper.h
@@ -42,6 +42,10 @@
#include <xmlsec/nss/app.h>
#include <xmlsec/nss/crypto.h>
#include <xmlsec/nss/pkikeys.h>
#include <xmlsec/nss/x509.h>
#endif
#ifdef XMLSEC_CRYPTO_MSCRYPTO
#include <xmlsec/mscng/x509.h>
#endif

/* vim:set shiftwidth=4 softtabstop=4 expandtab: */

xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx

diff --git a/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx b/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
index 0d3e72d..0f145cd 100644
--- a/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
+++ b/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
@@ -233,6 +233,10 @@ SAL_CALL XMLSignature_MSCryptImpl::validate(
    // We do certificate verification ourselves.
    pDsigCtx->keyInfoReadCtx.flags |= XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS;

    // limit possible key data to valid X509 certificates only, no KeyValues
    if (xmlSecPtrListAdd(&(pDsigCtx->keyInfoReadCtx.enabledKeyData), BAD_CAST xmlSecMSCngKeyDataX509GetKlass()) < 0)
        throw RuntimeException("failed to limit allowed key data");

    //Verify signature
    //The documentation says that the signature is only valid if the return value is 0 (that is, not < 0)
    //AND pDsigCtx->status == xmlSecDSigStatusSucceeded. That is, we must not make any assumptions, if

xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx

diff --git a/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx b/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
index 3fbece2..e637785 100644
--- a/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
+++ b/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
@@ -239,6 +239,10 @@ SAL_CALL XMLSignature_NssImpl::validate(
        // We do certificate verification ourselves.
        pDsigCtx->keyInfoReadCtx.flags |= XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS;

        // limit possible key data to valid X509 certificates only, no KeyValues
        if (xmlSecPtrListAdd(&(pDsigCtx->keyInfoReadCtx.enabledKeyData), BAD_CAST xmlSecNssKeyDataX509GetKlass()) < 0)
            throw RuntimeException("failed to limit allowed key data");

        //Verify signature
        int rs = xmlSecDSigCtxVerify( pDsigCtx.get() , pNode );