个人中心
gpt4 book ai didi

Java NPE 同时验证我自己的 XML 签名

转载 作者：行者123 更新时间：2023-11-30 06:52:14 25 4
gpt4 key购买 nike

我有一个已签名的 XML 请求，但由于签名无效而被第 3 方拒绝。因此，我自己写了签名验证代码来看看哪里出了问题。但是，我在验证刚刚创建的 XML 签名时收到了 NPE。 XML 如下所示(我删除了不相关的部分):

<?xml version="1.0" encoding="UTF-8"?>
<envelope xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:noNamespaceSchemaLocation="some_third_party.xsd">
    <header>...</header>
    <body>...</body>
    <Signature xmlns="http://www.w3.org/2000/09/xmldsig#" Id="MySignature">
        <SignedInfo>
            <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
            <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
            <Reference URI="">
                <Transforms>
                    <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                </Transforms>
                <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                <DigestValue>AaV+ejxBF8GjJvIZA9Bonw81Z1Y=</DigestValue>
            </Reference>
            <Reference Type="http://www.w3.org/2000/09/xmldsig#SignatureProperties" URI="#SignatureProperties">
                <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                <DigestValue>qcofYVnQ/n7sxKJPT5rG0+UYbjg=</DigestValue>
            </Reference>
        </SignedInfo>
        <SignatureValue>XXX</SignatureValue>
        <KeyInfo>
            <X509Data>
                <X509Certificate>XXX</X509Certificate>
            </X509Data>
        </KeyInfo>
        <Object Id="SignatureProperties">
            <SignatureProperties xmlns="">
                <SignatureProperty Id="TimeStamp" Target="#MySignature">
                    <TimeStamp>
                        <Date>2017-03-01</Date>
                        <Time>09:06:36.779+01:00</Time>
                    </TimeStamp>
                </SignatureProperty>
            </SignatureProperties>
        </Object>
    </Signature>
</envelope>

当我尝试验证此签名时，我在注释行上收到 NPE(因此在实际验证之前解码签名时实际上会发生这种情况):

// Omitted: extract the X509 Certificate from the document
DOMValidateContext valContext = new DOMValidateContext(cert.getPublicKey(), signature);
XMLSignatureFactory factory = XMLSignatureFactory.getInstance("DOM");
XMLSignature xmlSignature;
try {
    // Null pointer exception here!
    xmlSignature = factory.unmarshalXMLSignature(valContext);
} catch (MarshalException e) {
    // Handle exception
}

为了完整起见，以下是我创建签名的方法:

try {
    XMLSignatureFactory xmlSignatureFactory = XMLSignatureFactory.getInstance("DOM");

    Reference ref = xmlSignatureFactory.newReference("",
            xmlSignatureFactory.newDigestMethod(DigestMethod.SHA1, null),
            Collections.singletonList(xmlSignatureFactory.newTransform(Transform.ENVELOPED, (TransformParameterSpec) null)),
            null,
            null);

    Reference signatureRef = xmlSignatureFactory.newReference("#SignatureProperties",
            xmlSignatureFactory.newDigestMethod(DigestMethod.SHA1, null),
            null,
            "http://www.w3.org/2000/09/xmldsig#SignatureProperties",
            null);

    SignedInfo signedInfo = xmlSignatureFactory.newSignedInfo(xmlSignatureFactory.newCanonicalizationMethod(CanonicalizationMethod.INCLUSIVE, (C14NMethodParameterSpec) null),
            xmlSignatureFactory.newSignatureMethod(SignatureMethod.RSA_SHA1, null),
            Arrays.asList(ref, signatureRef));

    XMLObject xmlObject = xmlSignatureFactory.newXMLObject(Collections.singletonList(new DOMStructure(timestamp)),
            "SignatureProperties", null, null);

    KeyInfoFactory keyInfoFactory = xmlSignatureFactory.getKeyInfoFactory();
    List<Object> x509Content = new ArrayList<>();
    x509Content.add(certificate);
    X509Data xd = keyInfoFactory.newX509Data(x509Content);
    KeyInfo keyInfo = keyInfoFactory.newKeyInfo(Collections.singletonList(xd));

    XMLSignature xmlSignature = xmlSignatureFactory.newXMLSignature(signedInfo, keyInfo,
            Collections.singletonList(xmlObject), SIGNATURE_ID, null);
    DOMSignContext signContext = new DOMSignContext(privateKey, document.getDocumentElement());
    xmlSignature.sign(signContext);
} catch (InvalidAlgorithmParameterException | NoSuchAlgorithmException e) {
    // Handle exception
}

知道我在这里做错了什么吗？

编辑:添加堆栈跟踪以显示 NPE 的确切抛出位置:

java.lang.NullPointerException: null
    at org.jcp.xml.dsig.internal.dom.DOMXMLObject.<init>(DOMXMLObject.java:120)
    at org.jcp.xml.dsig.internal.dom.DOMXMLSignature.<init>(DOMXMLSignature.java:171)
    at org.jcp.xml.dsig.internal.dom.DOMXMLSignatureFactory.unmarshal(DOMXMLSignatureFactory.java:193)
    at org.jcp.xml.dsig.internal.dom.DOMXMLSignatureFactory.unmarshalXMLSignature(DOMXMLSignatureFactory.java:150)

编辑2:我还应该提到的是，SignedValue 和 X509Certificate 内容在创建签名后都有空格，这对我来说看起来很奇怪。例如

<X509Certificate>MIIG8DCCBdigAwIBAgIUJZSmBORuGuXyx48f04sNGHT+RhwwDQYJKoZIhvcNAQELBQAwWzELMAkG
    A1UEBhMCQ0gxEzARBgNVBAoTClBvc3QgQ0ggQUcxDTALBgNVBAsTBFBST0QxKDAmBgNVBAMTH1BL
    SSBTd2lzc1Bvc3QgTWFjaGluZSBBRVAgQ0EgRzMwHhcNMTcwMTI2MTIzMTQ0WhcNMjAwMTI2MTIz
    MTQ0WjCBsTELMAkGA1UEBhMCQ0gxCzAJBgNVBAgTAkZSMSAwHgYDVQQKExdEaWUgU2Nod2VpemVy
    ...

最佳答案

经过一番调试，我发现了这个问题。 DOMXMLObject 尝试获取 SignatureProperties 节点的本地名称，该节点返回 null。我稍微修改了创建该元素的方式，现在它工作正常。

我添加了这段代码，以防以后对其他人有用:

private Element createTimestamp(Document doc) {
    // Use createElementNS instead of createElement, otherwise you will get the aforementioned NPE
    Element signatureProperties = doc.createElementNS("", "SignatureProperties");
    Element signatureProperty = signatureProperties.getOwnerDocument().createElementNS("","SignatureProperty");
    signatureProperty.setAttribute("Target", "#" + SIGNATURE_ID);
    signatureProperty.setAttribute("Id", "TimeStamp");
    Element timeStamp = signatureProperty.getOwnerDocument().createElementNS("", "TimeStamp");

    ZonedDateTime now = ZonedDateTime.now(ZoneId.systemDefault());
    Element date = timeStamp.getOwnerDocument().createElementNS("", "Date");
    date.setTextContent(now.toLocalDate().toString());
    Element time = timeStamp.getOwnerDocument().createElementNS("", "Time");
    time.setTextContent(now.toLocalTime().toString() + now.getOffset().toString());

    timeStamp.appendChild(date);
    timeStamp.appendChild(time);
    signatureProperty.appendChild(timeStamp);
    signatureProperties.appendChild(signatureProperty);
    return signatureProperties;
}

此方法的结果将在这一行中使用:

XMLObject xmlObject = xmlSignatureFactory.newXMLObject(Collections.singletonList(new DOMStructure(createTimestamp(doc))),
                "SignatureProperties", null, null);

关于Java NPE 同时验证我自己的 XML 签名，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/42529990/

25 4 0
文章推荐： java - Vaadin:将枚举值绑定(bind)到组合框(ConversionException)
文章推荐： javascript - undefined offset : 1 after exploding "/"
文章推荐： java - Spring 数据存储库 - 检索所有记录的参数是什么？
文章推荐： javascript - 是否可以将 .val 与类一起使用？
行者123
个人简介

我是一名优秀的程序员,十分优秀！

滴滴打车优惠券免费领取
滴滴打车优惠券
全站热门文章
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com