diff options
| author | Thomas Lenz <thomas.lenz@egiz.gv.at> | 2017-06-23 11:58:29 +0200 |
|---|---|---|
| committer | Thomas Lenz <thomas.lenz@egiz.gv.at> | 2017-06-23 11:58:29 +0200 |
| commit | bbe653345bbb5dad2ed2356df6f817dd7de26528 (patch) | |
| tree | 1dfb88505f1871e2816513676a03b58db2e00046 /bkucommon/src/test/resources | |
| parent | 0603c0fbdfe028113431c65590b6e7e28929f6f6 (diff) | |
| download | mocca-bbe653345bbb5dad2ed2356df6f817dd7de26528.tar.gz mocca-bbe653345bbb5dad2ed2356df6f817dd7de26528.tar.bz2 mocca-bbe653345bbb5dad2ed2356df6f817dd7de26528.zip | |
fix another possible XXE, SSRF problem.
INFO: DocTypes are disabled by default for all XML content that should be signed with mocca!!! Consequently, XML and XAdES signatures for XML documents that contains a DocType declaration is not possible any more.
If DocType declarations are absolutely necessary than this feature can be skipped by set the Java System-Property "-Degiz.mocca.xades.xml.allow.doctype=true"
Diffstat (limited to 'bkucommon/src/test/resources')
| -rw-r--r-- | bkucommon/src/test/resources/at/gv/egiz/bku/slcommands/impl/SignatureInfo_Base64_4.xml | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/slcommands/impl/SignatureInfo_Base64_4.xml b/bkucommon/src/test/resources/at/gv/egiz/bku/slcommands/impl/SignatureInfo_Base64_4.xml new file mode 100644 index 00000000..d7950f1e --- /dev/null +++ b/bkucommon/src/test/resources/at/gv/egiz/bku/slcommands/impl/SignatureInfo_Base64_4.xml @@ -0,0 +1,13 @@ +<sl:CreateXMLSignatureRequest xmlns:sl="http://www.buergerkarte.at/namespaces/securitylayer/1.2#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"> + <sl:SignatureInfo> + <sl:SignatureEnvironment> + <sl:Base64Content>PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjwhRE9DVFlQRSByIFsNCiAgICA8IUVMRU1FTlQgciBBTlkgPg0KICAgIDwhRU5USVRZICUgc3AgU1lTVEVNICJodHRwOi8vdXBkYXRlLmVnaXouZ3YuYXQvdGVzdC5kdGQiPg0KICAgICVzcDsNCiAgICAlcGFyYW0xOw0KICAgICVleGZpbDsNCl0+DQo8WE1MRG9jdW1lbnQ+DQogICAgPFBhcmFncmFwaD5JY2ggYmluIGRlciBlcnN0ZSBBYnNhdHogaW4gZGllc2VtIERva3VtZW50LjwvUGFyYWdyYXBoPg0KICAgIDxQYXJhZ3JhcGggUGFyYUlkPSJQYXJhMiI+VW5kIGljaCBiaW4gZGVyIHp3ZWl0ZSBBYnNhdHogaW4gZGllc2VtIERva3VtZW50Lg0KICAgIEljaCBoYWJlIHdlaXRlcnMgZWluIGVpZ2VuZW5zIElELUF0dHJpYnV0IGJla29tbWVuLjwvUGFyYWdyYXBoPg0KPC9YTUxEb2N1bWVudD4=</sl:Base64Content> + </sl:SignatureEnvironment> + <sl:SignatureLocation xmlns:doc="urn:document" Index="1">/XMLDocument</sl:SignatureLocation> + <sl:Supplement> + <sl:Content Reference="urn:Document.dtd"> + <sl:LocRefContent>testlocal:Document.dtd</sl:LocRefContent> + </sl:Content> + </sl:Supplement> + </sl:SignatureInfo> +</sl:CreateXMLSignatureRequest>
\ No newline at end of file |