moparisthebest/poi
1
0
Fork 0
Code Issues Pull Requests Releases 1 Wiki Activity

Wrap more security related reflection in AccessController

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1713356 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Uwe Schindler 2015-11-09 09:32:37 +00:00
parent 8c3cd70589
commit ce66e14b5a
1 changed files with 27 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
src/ooxml/java/org/apache/poi/poifs/crypt/dsig/facets/SignatureFacet.java
View File

@ -26,8 +26,10 @@ package org.apache.poi.poifs.crypt.dsig.facets;
import java.lang.reflect.Field; import java.lang.reflect.Field;
import java.lang.reflect.Method; import java.lang.reflect.Method;
import java.security.AccessController;
import java.security.GeneralSecurityException; import java.security.GeneralSecurityException;
import java.security.MessageDigest; import java.security.MessageDigest;
import java.security.PrivilegedAction;
import java.security.Provider; import java.security.Provider;
import java.security.Security; import java.security.Security;
import java.util.List; import java.util.List;
@ -50,6 +52,7 @@ import org.apache.poi.poifs.crypt.dsig.SignatureConfig;
import org.apache.poi.poifs.crypt.dsig.SignatureConfig.SignatureConfigurable; import org.apache.poi.poifs.crypt.dsig.SignatureConfig.SignatureConfigurable;
import org.apache.poi.util.POILogFactory; import org.apache.poi.util.POILogFactory;
import org.apache.poi.util.POILogger; import org.apache.poi.util.POILogger;
import org.apache.poi.util.SuppressForbidden;
import org.w3c.dom.Document; import org.w3c.dom.Document;
/** /**
@ -156,25 +159,32 @@ public abstract class SignatureFacet implements SignatureConfigurable {
} }
// helper method ... will be removed soon // helper method ... will be removed soon
public static void brokenJvmWorkaround(Reference reference) { public static void brokenJvmWorkaround(final Reference reference) {
DigestMethod digestMethod = reference.getDigestMethod(); final DigestMethod digestMethod = reference.getDigestMethod();
String digestMethodUri = digestMethod.getAlgorithm(); final String digestMethodUri = digestMethod.getAlgorithm();
// workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1155012 final Provider bcProv = Security.getProvider("BC");
// overwrite standard message digest, if a digest <> SHA1 is used
Provider bcProv = Security.getProvider("BC");
if (bcProv != null && !DigestMethod.SHA1.equals(digestMethodUri)) { if (bcProv != null && !DigestMethod.SHA1.equals(digestMethodUri)) {
try { // workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1155012
Method m = DOMDigestMethod.class.getDeclaredMethod("getMessageDigestAlgorithm"); // overwrite standard message digest, if a digest <> SHA1 is used
m.setAccessible(true); AccessController.doPrivileged(new PrivilegedAction<Void>() {
String mdAlgo = (String)m.invoke(digestMethod); @Override
MessageDigest md = MessageDigest.getInstance(mdAlgo, bcProv); @SuppressForbidden("Workaround for a bug, needs access to private JDK members (may fail in Java 9): https://bugzilla.redhat.com/show_bug.cgi?id=1155012")
Field f = DOMReference.class.getDeclaredField("md"); public Void run() {
f.setAccessible(true); try {
f.set(reference, md); Method m = DOMDigestMethod.class.getDeclaredMethod("getMessageDigestAlgorithm");
} catch (Exception e) { m.setAccessible(true);
LOG.log(POILogger.WARN, "Can't overwrite message digest (workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1155012)", e); String mdAlgo = (String)m.invoke(digestMethod);
} MessageDigest md = MessageDigest.getInstance(mdAlgo, bcProv);
Field f = DOMReference.class.getDeclaredField("md");
f.setAccessible(true);
f.set(reference, md);
} catch (Exception e) {
LOG.log(POILogger.WARN, "Can't overwrite message digest (workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1155012)", e);
}
return null; // Void
}
});
} }
} }
} }