8278186: org.jcp.xml.dsig.internal.dom.Utils.parseIdFromSameDocumentURI throws StringIndexOutOfBoundsException when calling substring method

Backport-of: 1f1db838ab7d427170d59a8b55fdb45c4d80c359

Author: GoeLin

src/java.xml.crypto/share/classes/org/jcp/xml/dsig/internal/dom/DOMURIDereferencer.java

@@ -21,7 +21,7 @@
  * under the License.
  */
 /*
- * Copyright (c) 2005, 2016, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2021, Oracle and/or its affiliates. All rights reserved.
  */
 packageorg.jcp.xml.dsig.internal.dom;
 
@@ -101,7 +101,9 @@ public Data dereference(URIReference uriRef, XMLCryptoContext context)
 if (id.startsWith("xpointer(id(")) {
 inti1 = id.indexOf('\'');
 inti2 = id.indexOf('\'', i1+1);
-id = id.substring(i1+1, i2);
+if (i1 >= 0 && i2 >= 0) {
+id = id.substring(i1 + 1, i2);
+ }
  }
 
 // check if element is registered by Id

src/java.xml.crypto/share/classes/org/jcp/xml/dsig/internal/dom/Utils.java

@@ -21,7 +21,7 @@
  * under the License.
  */
 /*
- * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2021, Oracle and/or its affiliates. All rights reserved.
  */
 packageorg.jcp.xml.dsig.internal.dom;
 
@@ -94,7 +94,9 @@ public static String parseIdFromSameDocumentURI(String uri) {
 if (id.startsWith("xpointer(id(")) {
 inti1 = id.indexOf('\'');
 inti2 = id.indexOf('\'', i1+1);
-id = id.substring(i1+1, i2);
+if (i1 >= 0 && i2 >= 0) {
+id = id.substring(i1 + 1, i2);
+ }
  }
 returnid;
  }

test/jdk/javax/xml/crypto/dsig/BadXPointer.java

@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+importjdk.test.lib.Asserts;
+importjdk.test.lib.Utils;
+importjdk.test.lib.security.XMLUtils;
+
+importjavax.xml.crypto.URIReferenceException;
+importjavax.xml.crypto.dsig.XMLSignatureException;
+importjava.security.KeyPair;
+importjava.security.KeyPairGenerator;
+importjava.security.spec.ECGenParameterSpec;
+
+/**
+ * @test
+ * @bug 8278186
+ * @summary reject malformed xpointer(id('a')) gracefully
+ * @library /test/lib
+ * @modules java.xml.crypto
+ */
+publicclassBadXPointer {
+
+publicstaticvoidmain(String[] args) throwsException {
+
+KeyPairGeneratorkpg = KeyPairGenerator.getInstance("EC");
+kpg.initialize(newECGenParameterSpec("secp256r1"));
+KeyPairkp = kpg.generateKeyPair();
+
+varsigner = XMLUtils.signer(kp.getPrivate(), kp.getPublic());
+vardoc = XMLUtils.string2doc("<root/>");
+
+// No enclosing ' for id
+Utils.runAndCheckException(
+ () -> signer.signEnveloping(doc, "a", "#xpointer(id('a))"),
+ex -> Asserts.assertTrue(exinstanceofXMLSignatureException
+ && ex.getCause() instanceofURIReferenceException
+ && ex.getMessage().contains("Could not find a resolver"),
+ex.toString()));
+ }
+}

test/lib/jdk/test/lib/security/XMLUtils.java

@@ -92,9 +92,11 @@ public static void main(String[] args) throws Exception {
 Asserts.assertTrue(v2.validate(s3.sign(d))); // can read KeyInfo
 Asserts.assertTrue(v2.secureValidation(false).validate(s3.sign(p.toUri()))); // can read KeyInfo
 Asserts.assertTrue(v2.secureValidation(false).baseURI(b).validate(
-s3.sign(p.getParent().toUri(), p.getFileName().toUri()))); // can read KeyInfo
+s3.sign(p.toAbsolutePath().getParent().toUri(), p.getFileName().toUri()))); // can read KeyInfo
 Asserts.assertTrue(v1.validate(s1.sign("text"))); // plain text
 Asserts.assertTrue(v1.validate(s1.sign("binary".getBytes()))); // raw data
+Asserts.assertTrue(v1.validate(s1.signEnveloping(d, "x", "#x")));
+Asserts.assertTrue(v1.validate(s1.signEnveloping(d, "x", "#xpointer(id('x'))")));
  }
 
 //////////// CONVERT ////////////
@@ -347,14 +349,14 @@ public Document sign(Document document) throws Exception {
  }
 
 // Signs a document in enveloping mode
-publicDocumentsignEnveloping(Documentdocument) throwsException {
+publicDocumentsignEnveloping(Documentdocument, Stringid, Stringref) throwsException {
 DocumentnewDocument = DocumentBuilderFactory.newInstance()
  .newDocumentBuilder().newDocument();
 FAC.newXMLSignature(
-buildSignedInfo(FAC.newReference("#object", dm)),
+buildSignedInfo(FAC.newReference(ref, dm)),
 buildKeyInfo(),
 List.of(FAC.newXMLObject(List.of(newDOMStructure(document.getDocumentElement())),
-"object", null, null)),
+id, null, null)),
 null,
 null)
  .sign(newDOMSignContext(privateKey, newDocument));
@@ -474,7 +476,7 @@ public boolean validate(Document document) throws Exception {
 // If key is not null, any key from the signature will be ignored
 publicbooleanvalidate(Documentdocument, PublicKeykey)
 throwsException {
-NodeListnodeList = document.getElementsByTagName("Signature");
+NodeListnodeList = document.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
 if (nodeList.getLength() == 1) {
 NodesignatureNode = nodeList.item(0);
 if (signatureNode != null) {