naruto-lgtm opened a new pull request, #1498: URL: https://github.com/apache/poi/pull/1498
Repro: in a signed .docx (the new test uses `hello-world-signed.docx`), append a raw line feed to `Target="word/document.xml"` of the signed officeDocument relationship in `_rels/.rels`, then add a `word/document.xml%20` part with other content and an `Override` for it in `[Content_Types].xml`. `XWPFDocument` now shows the added part's text, but `SignatureInfo.verifySignature()` still returns true. Cause: `OOXMLURIDereferencer.dereference` removed every CR and LF byte from `.rels` parts before the relationship transform digested them, a workaround for Office 2007 pretty-printed `.rels`. `PackageRelationshipCollection` parses the same bytes with an XML parser, which reads a line break inside an attribute value as a space, and `PackagingURIHelper.toURI` percent-encodes the trailing space. The digest covers `word/document.xml` while the package resolves `/word/document.xml%20`. Fix: pass `.rels` parts to the transform unchanged. `RelationshipTransformService` rebuilds `<Relationships>` from the signed `Relationship` elements only, so whitespace between elements never reaches the digest (this was already the case before #1467), and `office2007prettyPrintedRels.docx` and the other signed samples still verify. As a side effect, a `.rels` with a line break between attributes is no longer turned into malformed XML by the stripping. The dsig, crypt and openxml4j tests pass, including the sign-then-verify round trips, and `TestSignatureInfo.testLineBreakInSignedRelationshipTarget` fails before the change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
