summaryrefslogtreecommitdiff
path: root/bkucommon/src/test
diff options
context:
space:
mode:
authorBianca Schnalzer <bianca.schnalzer@egiz.gv.at>2017-06-23 12:08:06 +0200
committerBianca Schnalzer <bianca.schnalzer@egiz.gv.at>2017-06-23 12:08:06 +0200
commit08ce5e1262d7b115e0350e445de97c78f9f4c597 (patch)
tree1dfb88505f1871e2816513676a03b58db2e00046 /bkucommon/src/test
parent2b395988ade78c58e6feaf55bd6ec129cf5f8e6f (diff)
parentbbe653345bbb5dad2ed2356df6f817dd7de26528 (diff)
downloadmocca-08ce5e1262d7b115e0350e445de97c78f9f4c597.tar.gz
mocca-08ce5e1262d7b115e0350e445de97c78f9f4c597.tar.bz2
mocca-08ce5e1262d7b115e0350e445de97c78f9f4c597.zip
Merge branch 'manuell_XXE_and_SSRF_validation' into 'master'
Manuell xxe and ssrf validation
Diffstat (limited to 'bkucommon/src/test')
-rw-r--r--bkucommon/src/test/java/at/gv/egiz/bku/slcommands/impl/xsect/SignatureTest.java52
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/slcommands/impl/SignatureInfo_Base64_4.xml13
2 files changed, 64 insertions, 1 deletions
diff --git a/bkucommon/src/test/java/at/gv/egiz/bku/slcommands/impl/xsect/SignatureTest.java b/bkucommon/src/test/java/at/gv/egiz/bku/slcommands/impl/xsect/SignatureTest.java
index 23fdfc17..6e5612f6 100644
--- a/bkucommon/src/test/java/at/gv/egiz/bku/slcommands/impl/xsect/SignatureTest.java
+++ b/bkucommon/src/test/java/at/gv/egiz/bku/slcommands/impl/xsect/SignatureTest.java
@@ -317,13 +317,54 @@ public class SignatureTest {
}
@Test
+ public void testSetSignature_Base64_WITH_DISALLOWED_DOCTYPE_And_SystemParameter() throws JAXBException, SLCommandException, XMLStreamException {
+
+ SignatureInfoCreationType signatureInfo = unmarshalSignatureInfo("SignatureInfo_Base64_2.xml");
+
+ Signature signature = new Signature(urlDereferencer, new IdValueFactoryImpl(), null, false);
+
+ //allow DocTypes to perform this test
+ System.setProperty(Signature.SYSTEM_PROPERTY_ALLOW_DOCTYPES, String.valueOf(Boolean.FALSE));
+ try {
+ signature.setSignatureInfo(signatureInfo);
+ assertTrue("Check_ALLOW_DOCTYPES_System_Property", false);
+
+ } catch (SLCommandException e) {
+ assertTrue("Check_ALLOW_DOCTYPES_System_Property", true);
+
+ }
+ }
+
+ @Test
+ public void testSetSignature_Base64_WITH_DISALLOWED_DOCTYPE_WithOut_SystemParameter() throws JAXBException, SLCommandException, XMLStreamException {
+
+ SignatureInfoCreationType signatureInfo = unmarshalSignatureInfo("SignatureInfo_Base64_2.xml");
+
+ Signature signature = new Signature(urlDereferencer, new IdValueFactoryImpl(), null, false);
+
+ //allow DocTypes to perform this test
+ System.clearProperty(Signature.SYSTEM_PROPERTY_ALLOW_DOCTYPES);
+ try {
+ signature.setSignatureInfo(signatureInfo);
+ assertTrue("Check_ALLOW_DOCTYPES_WithOut_System_Property", false);
+
+ } catch (SLCommandException e) {
+ assertTrue("Check_ALLOW_DOCTYPES_WithOut_System_Property", true);
+
+ }
+ }
+
+ @Test
public void testSetSignature_Base64_2() throws JAXBException, SLCommandException, XMLStreamException {
SignatureInfoCreationType signatureInfo = unmarshalSignatureInfo("SignatureInfo_Base64_2.xml");
Signature signature = new Signature(urlDereferencer, new IdValueFactoryImpl(), null, false);
+ //allow DocTypes to perform this test
+ System.setProperty(Signature.SYSTEM_PROPERTY_ALLOW_DOCTYPES, String.valueOf(Boolean.TRUE));
signature.setSignatureInfo(signatureInfo);
+ System.setProperty(Signature.SYSTEM_PROPERTY_ALLOW_DOCTYPES, String.valueOf(Boolean.FALSE));
Node parent = signature.getParent();
Node nextSibling = signature.getNextSibling();
@@ -343,7 +384,10 @@ public class SignatureTest {
Signature signature = new Signature(urlDereferencer, new IdValueFactoryImpl(), null, true);
+ //allow DocTypes to perform this test
+ System.setProperty(Signature.SYSTEM_PROPERTY_ALLOW_DOCTYPES, String.valueOf(Boolean.TRUE));
signature.setSignatureInfo(signatureInfo);
+ System.setProperty(Signature.SYSTEM_PROPERTY_ALLOW_DOCTYPES, String.valueOf(Boolean.FALSE));
Node parent = signature.getParent();
Node nextSibling = signature.getNextSibling();
@@ -363,7 +407,10 @@ public class SignatureTest {
Signature signature = new Signature(urlDereferencer, new IdValueFactoryImpl(), null, false);
+ //allow DocTypes to perform this test
+ System.setProperty(Signature.SYSTEM_PROPERTY_ALLOW_DOCTYPES, String.valueOf(Boolean.TRUE));
signature.setSignatureInfo(signatureInfo);
+ System.setProperty(Signature.SYSTEM_PROPERTY_ALLOW_DOCTYPES, String.valueOf(Boolean.FALSE));
Node parent = signature.getParent();
Node nextSibling = signature.getNextSibling();
@@ -383,7 +430,10 @@ public class SignatureTest {
Signature signature = new Signature(urlDereferencer, new IdValueFactoryImpl(), null, true);
- signature.setSignatureInfo(signatureInfo);
+ //allow DocTypes to perform this test
+ System.setProperty(Signature.SYSTEM_PROPERTY_ALLOW_DOCTYPES, String.valueOf(Boolean.TRUE));
+ signature.setSignatureInfo(signatureInfo);
+ System.setProperty(Signature.SYSTEM_PROPERTY_ALLOW_DOCTYPES, String.valueOf(Boolean.FALSE));
Node parent = signature.getParent();
Node nextSibling = signature.getNextSibling();
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/slcommands/impl/SignatureInfo_Base64_4.xml b/bkucommon/src/test/resources/at/gv/egiz/bku/slcommands/impl/SignatureInfo_Base64_4.xml
new file mode 100644
index 00000000..d7950f1e
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/slcommands/impl/SignatureInfo_Base64_4.xml
@@ -0,0 +1,13 @@
+<sl:CreateXMLSignatureRequest xmlns:sl="http://www.buergerkarte.at/namespaces/securitylayer/1.2#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
+ <sl:SignatureInfo>
+ <sl:SignatureEnvironment>
+ <sl:Base64Content>PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjwhRE9DVFlQRSByIFsNCiAgICA8IUVMRU1FTlQgciBBTlkgPg0KICAgIDwhRU5USVRZICUgc3AgU1lTVEVNICJodHRwOi8vdXBkYXRlLmVnaXouZ3YuYXQvdGVzdC5kdGQiPg0KICAgICVzcDsNCiAgICAlcGFyYW0xOw0KICAgICVleGZpbDsNCl0+DQo8WE1MRG9jdW1lbnQ+DQogICAgPFBhcmFncmFwaD5JY2ggYmluIGRlciBlcnN0ZSBBYnNhdHogaW4gZGllc2VtIERva3VtZW50LjwvUGFyYWdyYXBoPg0KICAgIDxQYXJhZ3JhcGggUGFyYUlkPSJQYXJhMiI+VW5kIGljaCBiaW4gZGVyIHp3ZWl0ZSBBYnNhdHogaW4gZGllc2VtIERva3VtZW50Lg0KICAgIEljaCBoYWJlIHdlaXRlcnMgZWluIGVpZ2VuZW5zIElELUF0dHJpYnV0IGJla29tbWVuLjwvUGFyYWdyYXBoPg0KPC9YTUxEb2N1bWVudD4=</sl:Base64Content>
+ </sl:SignatureEnvironment>
+ <sl:SignatureLocation xmlns:doc="urn:document" Index="1">/XMLDocument</sl:SignatureLocation>
+ <sl:Supplement>
+ <sl:Content Reference="urn:Document.dtd">
+ <sl:LocRefContent>testlocal:Document.dtd</sl:LocRefContent>
+ </sl:Content>
+ </sl:Supplement>
+ </sl:SignatureInfo>
+</sl:CreateXMLSignatureRequest> \ No newline at end of file