Skip to content

Commit 9491bcc

Browse files
metsmakristelmerilain
metsma
authored and
kristelmerilain
committed
Catch processing exceptions and add to list
IB-8568 Signed-off-by: Raul Metsma <[email protected]>
1 parent 83fcde4 commit 9491bcc

File tree

4 files changed

+125
-113
lines changed

4 files changed

+125
-113
lines changed

‎src/SignatureXAdES_B.cpp

Lines changed: 119 additions & 113 deletions
Original file line numberDiff line numberDiff line change
@@ -409,144 +409,150 @@ void SignatureXAdES_B::validate(const string &policy) const
409409
// It'll be only thrown in case we have a reason (cause).
410410
Exception exception(EXCEPTION_PARAMS("Signature validation"));
411411

412-
if(!Exception::hasWarningIgnore(Exception::SignatureDigestWeak) &&
413-
Digest::isWeakDigest(signatureMethod()))
414-
{
415-
Exception e(EXCEPTION_PARAMS("Signature digest weak"));
416-
e.setCode(Exception::SignatureDigestWeak);
417-
exception.addCause(e);
418-
}
412+
try {
413+
if(!Exception::hasWarningIgnore(Exception::SignatureDigestWeak) &&
414+
Digest::isWeakDigest(signatureMethod()))
415+
{
416+
Exception e(EXCEPTION_PARAMS("Signature digest weak"));
417+
e.setCode(Exception::SignatureDigestWeak);
418+
exception.addCause(e);
419+
}
419420

420-
if(profile().find(ASiC_E::ASIC_TM_PROFILE) != string::npos)
421-
{
422-
if(SPUri().empty())
423-
EXCEPTION_ADD(exception, "Signature SPUri is missing");
424-
if(auto p = policylist.find(SignatureXAdES_B::policy()); p == policylist.cend())
425-
EXCEPTION_ADD(exception, "Signature policy does not match BDOC 2.1 policy");
426-
else if(auto identifier = signedSignatureProperties()/"SignaturePolicyIdentifier"; !identifier)
427-
EXCEPTION_ADD(exception, "Signature policy digest is missing");
428-
else if(auto id = identifier/"SignaturePolicyId"; !id)
429-
EXCEPTION_ADD(exception, "Signature policy digest is missing");
430-
else
421+
if(profile().find(ASiC_E::ASIC_TM_PROFILE) != string::npos)
431422
{
432-
#if 0 //Disabled IB-3684
433-
auto hash = id/"SigPolicyHash";
434-
auto algo = (hash/DigestMethod)["Algorithm"];
435-
vector<unsigned char> digest = hash/DigestValue;
436-
437-
bool valid = false;
438-
if(algo == URI_SHA1) valid = digest == p->second.SHA1;
439-
else if(algo == URI_SHA224) valid = digest == p->second.SHA224;
440-
else if(algo == URI_SHA256) valid = digest == p->second.SHA256;
441-
else if(algo == URI_SHA384) valid = digest == p->second.SHA384;
442-
else if(algo == URI_SHA512) valid = digest == p->second.SHA512;
423+
if(SPUri().empty())
424+
EXCEPTION_ADD(exception, "Signature SPUri is missing");
425+
if(auto p = policylist.find(SignatureXAdES_B::policy()); p == policylist.cend())
426+
EXCEPTION_ADD(exception, "Signature policy does not match BDOC 2.1 policy");
427+
else if(auto identifier = signedSignatureProperties()/"SignaturePolicyIdentifier"; !identifier)
428+
EXCEPTION_ADD(exception, "Signature policy digest is missing");
429+
else if(auto id = identifier/"SignaturePolicyId"; !id)
430+
EXCEPTION_ADD(exception, "Signature policy digest is missing");
443431
else
444-
EXCEPTION_ADD(exception, "Signature policy unknwon digest method");
445-
446-
if(!valid)
447-
EXCEPTION_ADD(exception, "Signature policy digest does not match");
432+
{
433+
#if 0 //Disabled IB-3684
434+
auto hash = id/"SigPolicyHash";
435+
auto algo = (hash/DigestMethod)["Algorithm"];
436+
vector<unsigned char> digest = hash/DigestValue;
437+
438+
bool valid = false;
439+
if(algo == URI_SHA1) valid = digest == p->second.SHA1;
440+
else if(algo == URI_SHA224) valid = digest == p->second.SHA224;
441+
else if(algo == URI_SHA256) valid = digest == p->second.SHA256;
442+
else if(algo == URI_SHA384) valid = digest == p->second.SHA384;
443+
else if(algo == URI_SHA512) valid = digest == p->second.SHA512;
444+
else
445+
EXCEPTION_ADD(exception, "Signature policy unknwon digest method");
446+
447+
if(!valid)
448+
EXCEPTION_ADD(exception, "Signature policy digest does not match");
448449
#endif
450+
}
449451
}
450-
}
451452

452-
cb_doc = bdoc;
453-
cb_exception = &exception;
454-
bool result = XMLDocument::verifySignature(signature, &exception);
455-
cb_doc = {};
456-
cb_exception = {};
457-
if(!result)
458-
EXCEPTION_ADD(exception, "Failed to validate signature");
459-
460-
auto sp = qualifyingProperties()/"SignedProperties";
461-
auto sdop = sp/"SignedDataObjectProperties";
462-
map<string,string> mimeinfo;
463-
if(sdop)
464-
{
465-
for(auto data = sdop/"DataObjectFormat"; data; data++)
453+
cb_doc = bdoc;
454+
cb_exception = &exception;
455+
bool result = XMLDocument::verifySignature(signature, &exception);
456+
cb_doc = {};
457+
cb_exception = {};
458+
if(!result)
459+
EXCEPTION_ADD(exception, "Failed to validate signature");
460+
461+
auto sp = qualifyingProperties()/"SignedProperties";
462+
auto sdop = sp/"SignedDataObjectProperties";
463+
map<string,string> mimeinfo;
464+
if(sdop)
466465
{
467-
if(auto mime = data/"MimeType")
468-
mimeinfo.emplace(data["ObjectReference"], mime);
466+
for(auto data = sdop/"DataObjectFormat"; data; data++)
467+
{
468+
if(auto mime = data/"MimeType")
469+
mimeinfo.emplace(data["ObjectReference"], mime);
470+
}
469471
}
470-
}
471-
else
472-
{
473-
// ADoc 1.0 does not add DataObjectProperties>DataObjectFormat elements
474-
if(bdoc->mediaType() != ASiC_E::MIMETYPE_ADOC)
475-
EXCEPTION_ADD(exception, "DataObjectFormat element is missing");
476-
}
477-
478-
map<string,string> signatureref;
479-
string_view signedPropertiesId = sp["Id"];
480-
bool signedInfoFound = false;
481-
for(auto ref = signature/"SignedInfo"/"Reference"; ref; ref++)
482-
{
483-
auto uri = ref["URI"];
484-
if(uri.empty())
472+
else
485473
{
486-
EXCEPTION_ADD(exception, "Reference URI missing");
487-
continue;
474+
// ADoc 1.0 does not add DataObjectProperties>DataObjectFormat elements
475+
if(bdoc->mediaType() != ASiC_E::MIMETYPE_ADOC)
476+
EXCEPTION_ADD(exception, "DataObjectFormat element is missing");
488477
}
489478

490-
if(!Exception::hasWarningIgnore(Exception::ReferenceDigestWeak) &&
491-
Digest::isWeakDigest((ref/DigestMethod)["Algorithm"]))
479+
map<string,string> signatureref;
480+
string_view signedPropertiesId = sp["Id"];
481+
bool signedInfoFound = false;
482+
for(auto ref = signature/"SignedInfo"/"Reference"; ref; ref++)
492483
{
493-
Exception e(EXCEPTION_PARAMS("Reference '%.*s' digest weak", int(uri.size()), uri.data()));
494-
e.setCode(Exception::ReferenceDigestWeak);
495-
exception.addCause(e);
496-
}
484+
auto uri = ref["URI"];
485+
if(uri.empty())
486+
{
487+
EXCEPTION_ADD(exception, "Reference URI missing");
488+
continue;
489+
}
497490

498-
if(uri.front() == '#' && uri.substr(1) == signedPropertiesId && ref["Type"] == REF_TYPE)
499-
signedInfoFound = true;
500-
else if(!sdop)
501-
continue; // DataObjectProperties is missing, no need to match later MediaTypes
502-
else if(ref["Id"].empty())
503-
EXCEPTION_ADD(exception, "Reference '%.*s' ID missing", int(uri.size()), uri.data());
504-
else
505-
{
506-
string uriPath = File::fromUriPath(uri);
507-
if(uriPath.front() == '/')
508-
uriPath.erase(0);
509-
signatureref.emplace(uriPath, mimeinfo[string("#").append(ref["Id"])]);
491+
if(!Exception::hasWarningIgnore(Exception::ReferenceDigestWeak) &&
492+
Digest::isWeakDigest((ref/DigestMethod)["Algorithm"]))
493+
{
494+
Exception e(EXCEPTION_PARAMS("Reference '%.*s' digest weak", int(uri.size()), uri.data()));
495+
e.setCode(Exception::ReferenceDigestWeak);
496+
exception.addCause(e);
497+
}
498+
499+
if(uri.front() == '#' && uri.substr(1) == signedPropertiesId && ref["Type"] == REF_TYPE)
500+
signedInfoFound = true;
501+
else if(!sdop)
502+
continue; // DataObjectProperties is missing, no need to match later MediaTypes
503+
else if(ref["Id"].empty())
504+
EXCEPTION_ADD(exception, "Reference '%.*s' ID missing", int(uri.size()), uri.data());
505+
else
506+
{
507+
string uriPath = File::fromUriPath(uri);
508+
if(uriPath.front() == '/')
509+
uriPath.erase(0);
510+
signatureref.emplace(uriPath, mimeinfo[string("#").append(ref["Id"])]);
511+
}
510512
}
511-
}
512-
if(!signedInfoFound)
513-
EXCEPTION_ADD(exception, "SignedProperties not found");
513+
if(!signedInfoFound)
514+
EXCEPTION_ADD(exception, "SignedProperties not found");
514515

515-
// Match DataObjectFormat element MediaTypes with Manifest
516-
if(!signatureref.empty())
517-
{
518-
for(const DataFile *file: bdoc->dataFiles())
516+
// Match DataObjectFormat element MediaTypes with Manifest
517+
if(!signatureref.empty())
519518
{
520-
if(auto i = signatureref.find(file->fileName()); i != signatureref.end())
519+
for(const DataFile *file: bdoc->dataFiles())
521520
{
522-
if(bdoc->mediaType() != ASiContainer::MIMETYPE_ASIC_S && i->second != file->mediaType())
523-
EXCEPTION_ADD(exception, "Manifest datafile '%s' mime '%s' does not match signature mime '%s'",
524-
file->fileName().c_str(), file->mediaType().c_str(), i->second.c_str());
525-
static const regex reg(R"(([\w])*/([\w\-\+\.])*)");
526-
if(!file->mediaType().empty() && !regex_match(file->mediaType(), reg))
521+
if(auto i = signatureref.find(file->fileName()); i != signatureref.end())
527522
{
528-
Exception w(EXCEPTION_PARAMS("'%s' is not conformant mime-type string!", file->mediaType().c_str()));
529-
w.setCode(Exception::MimeTypeWarning);
530-
exception.addCause(w);
523+
if(bdoc->mediaType() != ASiContainer::MIMETYPE_ASIC_S && i->second != file->mediaType())
524+
EXCEPTION_ADD(exception, "Manifest datafile '%s' mime '%s' does not match signature mime '%s'",
525+
file->fileName().c_str(), file->mediaType().c_str(), i->second.c_str());
526+
static const regex reg(R"(([\w])*/([\w\-\+\.])*)");
527+
if(!file->mediaType().empty() && !regex_match(file->mediaType(), reg))
528+
{
529+
Exception w(EXCEPTION_PARAMS("'%s' is not conformant mime-type string!", file->mediaType().c_str()));
530+
w.setCode(Exception::MimeTypeWarning);
531+
exception.addCause(w);
532+
}
533+
signatureref.erase(i);
531534
}
532-
signatureref.erase(i);
535+
else
536+
EXCEPTION_ADD(exception, "Manifest datafile not listed in signature references %s", file->fileName().c_str());
533537
}
534-
else
535-
EXCEPTION_ADD(exception, "Manifest datafile not listed in signature references %s", file->fileName().c_str());
536538
}
537-
}
538539

539-
if(bdoc->dataFiles().empty())
540-
EXCEPTION_ADD(exception, "No DataFiles signed");
540+
if(bdoc->dataFiles().empty())
541+
EXCEPTION_ADD(exception, "No DataFiles signed");
541542

542-
if(!signatureref.empty())
543-
EXCEPTION_ADD(exception, "Manifest references and signature references do not match");
543+
if(!signatureref.empty())
544+
EXCEPTION_ADD(exception, "Manifest references and signature references do not match");
544545

545-
try { checkKeyInfo(); }
546-
catch(const Exception& e) { exception.addCause(e); }
546+
try { checkKeyInfo(); }
547+
catch(const Exception& e) { exception.addCause(e); }
547548

548-
try { checkSigningCertificate(policy == POLv1); }
549-
catch(const Exception& e) { exception.addCause(e); }
549+
try { checkSigningCertificate(policy == POLv1); }
550+
catch(const Exception& e) { exception.addCause(e); }
551+
} catch(const Exception &e) {
552+
exception.addCause(e);
553+
} catch(...) {
554+
EXCEPTION_ADD(exception, "Failed to validate signature");
555+
}
550556

551557
if(!exception.causes().empty())
552558
throw exception;

‎src/SignatureXAdES_LT.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,8 @@ void SignatureXAdES_LT::validate(const string &policy) const
194194
}
195195
} catch(const Exception &e) {
196196
exception.addCause(e);
197+
} catch(...) {
198+
EXCEPTION_ADD(exception, "Failed to validate signature");
197199
}
198200
if(!exception.causes().empty())
199201
throw exception;

‎src/SignatureXAdES_LTA.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,8 @@ void SignatureXAdES_LTA::validate(const string &policy) const
162162
});
163163
} catch(const Exception &e) {
164164
exception.addCause(e);
165+
} catch(...) {
166+
EXCEPTION_ADD(exception, "Failed to validate signature");
165167
}
166168
if(!exception.causes().empty())
167169
throw exception;

‎src/SignatureXAdES_T.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,8 @@ void SignatureXAdES_T::validate(const std::string &policy) const
178178
}
179179
} catch(const Exception &e) {
180180
exception.addCause(e);
181+
} catch(...) {
182+
EXCEPTION_ADD(exception, "Failed to validate signature");
181183
}
182184
if(!exception.causes().empty())
183185
throw exception;

0 commit comments

Comments
 (0)